From b1b4beb16197275648603fd04fad992985a9b29f Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 5 Jun 2019 11:11:45 -0700 Subject: [PATCH 01/57] Added a note for reboot --- .../mdm/policy-csp-textinput.md | 232 ++++++++++++++++++ 1 file changed, 232 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 0cfafcfe1b..43fdafc317 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -59,6 +59,18 @@ manager: dansimp
TextInput/AllowLinguisticDataCollection
+
+ TextInput/ConfigureSimplifiedChineseIMEVersion +
+
+ TextInput/ConfigureTraditionalChineseIMEVersion +
+
+ TextInput/ConfigureJapaneseIMEVersion +
+
+ TextInput/ConfigureKoreanIMEVersion +
TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
@@ -705,6 +717,226 @@ This setting supports a range of values between 0 and 1.
+ +**TextInput/ConfigureSimplifiedChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark8check mark8check mark8check mark8cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTES] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in 20H1. Allows IT admins to configure the Microsoft Simplified Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. + + + + +
+ + +**TextInput/ConfigureTraditionalChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark8check mark8check mark8check mark8cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTES] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in 20H1. Allows IT admins to configure the Microsoft Traditional Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. + + + + +
+ + +**TextInput/ConfigureJapaneseIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark8check mark8check mark8check mark8cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTES] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in 20H1. Allows IT admins to configure the Microsoft Japanese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. + + + + +
+ + +**TextInput/ConfigureKoreanIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark8check mark8check mark8check mark8cross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTES] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in 20H1. Allows IT admins to configure the Microsoft Korean IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. +- 2 - Does not allow you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. + + + + +
+ **TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode** From 87d6485641c8c6a3aaec09071bc1b902bd0b5a98 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 5 Jun 2019 12:02:57 -0700 Subject: [PATCH 02/57] Updated note --- .../client-management/mdm/policy-csp-textinput.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 43fdafc317..92c664f842 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -67,10 +67,10 @@ manager: dansimp
TextInput/ConfigureJapaneseIMEVersion -
+
TextInput/ConfigureKoreanIMEVersion -
+
TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
@@ -753,7 +753,7 @@ This setting supports a range of values between 0 and 1. -> [!NOTES] +> [!NOTE] > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. @@ -808,7 +808,7 @@ The following list shows the supported values: -> [!NOTES] +> [!NOTE] > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. @@ -863,8 +863,8 @@ The following list shows the supported values: -> [!NOTES] -> - This policy is enforced only in Windows 10 for desktop. +> [!NOTE] +> - The policy is only enforced in Windows 10 for desktop. > - This policy requires reboot to take effect. Added in 20H1. Allows IT admins to configure the Microsoft Japanese IME version in the desktop. @@ -918,7 +918,7 @@ The following list shows the supported values: -> [!NOTES] +> [!NOTE] > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. From 986029e98f7154734d3d6fb5231ff5a6b4d0bf29 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 15 Aug 2019 17:09:50 +0530 Subject: [PATCH 03/57] Added 20H1 policies --- .../mdm/policy-csp-deviceinstallation.md | 158 +++++++++++++++++- 1 file changed, 156 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index e137a5dc9f..3df85a5ecf 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -11,6 +11,8 @@ author: manikadhiman --- # Policy CSP - DeviceInstallation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -24,6 +26,9 @@ author: manikadhiman
DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
+
+ DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
DeviceInstallation/PreventDeviceMetadataFromNetwork
@@ -33,12 +38,14 @@ author: manikadhiman
DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
+
+ DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
-
@@ -264,6 +271,79 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i
+ +**DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. + +If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Allow* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + + + + + + + + +
+ **DeviceInstallation/PreventDeviceMetadataFromNetwork** @@ -546,6 +626,80 @@ For example, this custom profile blocks installation and usage of USB devices wi +
+ + +**DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Deny* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + + + + + + + + +
**DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses** @@ -661,6 +815,6 @@ Footnote: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. \ No newline at end of file From a1cf16038a4c05135af71d9bf73f6b110849269c Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 20 Aug 2019 14:37:44 +0530 Subject: [PATCH 04/57] Added Audit policies --- .../client-management/mdm/policy-csp-audit.md | 3623 +++++++++++++++++ 1 file changed, 3623 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-audit.md diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..08e3891e5b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,3623 @@ +--- +title: Policy CSP - Audit +description: Policy CSP - Audit +ms.author: Heidi.Lohr +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: Heidilohr +ms.date: 08/13/2019 +--- + +# Policy CSP - Audit + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
+ + +## Audit policies + +
+
+ Audit/AccountLogonLogoff_AuditAccountLockout +
+
+ Audit/AccountLogonLogoff_AuditGroupMembership +
+
+ Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecMainMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecQuickMode +
+
+ Audit/AccountLogonLogoff_AuditLogoff +
+
+ Audit/AccountLogonLogoff_AuditLogon +
+
+ Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
+
+ Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
+
+ Audit/AccountLogonLogoff_AuditSpecialLogon +
+
+ Audit/AccountLogonLogoff_AuditUserDeviceClaims +
+
+ Audit/AccountLogon_AuditCredentialValidation +
+
+ Audit/AccountLogon_AuditKerberosAuthenticationService +
+
+ Audit/AccountLogon_AuditKerberosServiceTicketOperations +
+
+ Audit/AccountLogon_AuditOtherAccountLogonEvents +
+
+ Audit/AccountManagement_AuditApplicationGroupManagement +
+
+ Audit/AccountManagement_AuditComputerAccountManagement +
+
+ Audit/AccountManagement_AuditDistributionGroupManagement +
+
+ Audit/AccountManagement_AuditOtherAccountManagementEvents +
+
+ Audit/AccountManagement_AuditSecurityGroupManagement +
+
+ Audit/AccountManagement_AuditUserAccountManagement +
+
+ Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
+
+ Audit/DSAccess_AuditDirectoryServiceAccess +
+
+ Audit/DSAccess_AuditDirectoryServiceChanges +
+
+ Audit/DSAccess_AuditDirectoryServiceReplication +
+
+ Audit/DetailedTracking_AuditDPAPIActivity +
+
+ Audit/DetailedTracking_AuditPNPActivity +
+
+ Audit/DetailedTracking_AuditProcessCreation +
+
+ Audit/DetailedTracking_AuditProcessTermination +
+
+ Audit/DetailedTracking_AuditRPCEvents +
+
+ Audit/DetailedTracking_AuditTokenRightAdjusted +
+
+ Audit/ObjectAccess_AuditApplicationGenerated +
+
+ Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
+
+ Audit/ObjectAccess_AuditCertificationServices +
+
+ Audit/ObjectAccess_AuditDetailedFileShare +
+
+ Audit/ObjectAccess_AuditFileShare +
+
+ Audit/ObjectAccess_AuditFileSystem +
+
+ Audit/ObjectAccess_AuditFilteringPlatformConnection +
+
+ Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
+
+ Audit/ObjectAccess_AuditHandleManipulation +
+
+ Audit/ObjectAccess_AuditKernelObject +
+
+ Audit/ObjectAccess_AuditOtherObjectAccessEvents +
+
+ Audit/ObjectAccess_AuditRegistry +
+
+ Audit/ObjectAccess_AuditRemovableStorage +
+
+ Audit/ObjectAccess_AuditSAM +
+
+ Audit/PolicyChange_AuditAuthenticationPolicyChange +
+
+ Audit/PolicyChange_AuditAuthorizationPolicyChange +
+
+ Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
+
+ Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
+
+ Audit/PolicyChange_AuditOtherPolicyChangeEvents +
+
+ Audit/PolicyChange_AuditPolicyChange +
+
+ Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
+
+ Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
+
+ Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
+
+ Audit/System_AuditIPsecDriver +
+
+ Audit/System_AuditOtherSystemEvents +
+
+ Audit/System_AuditSecurityStateChange +
+
+ Audit/System_AuditSecuritySystemExtension +
+
+ Audit/System_AuditSystemIntegrity +
+
+ + +
+ + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + + + +
+ + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + + + +
+ + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + + + +
+ + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + + + +
+ + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + + + +
+ + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + + + +
+ + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + + + +
+ + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Not used. + + + + + + + + + + + + + +
+ + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + + + +
+ + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + + + +
+ + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark6check mark6check mark6check mark6
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + + +
+ +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + From 581d943598b74fb33cc9bdc1bcb9aae3826f0389 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 20 Aug 2019 15:32:42 +0530 Subject: [PATCH 05/57] Updated TOC for Audit policies --- windows/client-management/mdm/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d77896805e..c90eee3566 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -168,6 +168,7 @@ #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) #### [Bitlocker](policy-csp-bitlocker.md) From 49bddd1894a92c4f345f08fede14be26c9c9f476 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 29 Aug 2019 09:43:19 -0700 Subject: [PATCH 06/57] Added SyncML examples --- .../mdm/policy-csp-deviceinstallation.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 3df85a5ecf..192db804ab 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -335,7 +335,33 @@ ADMX Info: +To enable this policy, use the following SyncML. +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` @@ -692,7 +718,34 @@ ADMX Info: +To enable this policy, use the following SyncML. +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: + +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` From 5ab29360b2fe1fad60e6a5a735bc6e4f80e27b5f Mon Sep 17 00:00:00 2001 From: Jose Ortega Date: Tue, 10 Sep 2019 01:47:51 -0500 Subject: [PATCH 07/57] Added important note for issue #4836 --- .../information-protection/bitlocker/bitlocker-overview.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index d15b81c76a..40f47bbe5b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -60,6 +60,9 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> You can use an OS drive encrypted without TPM and USB stick, from windows 7, [check procedure here](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). + > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From db75f2d43a9d3222e3e296774bfc1ef4359c1e66 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Tue, 10 Sep 2019 10:57:02 -0500 Subject: [PATCH 08/57] Update windows/security/information-protection/bitlocker/bitlocker-overview.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 40f47bbe5b..b15072b8b2 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -61,7 +61,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. > [!IMPORTANT] -> You can use an OS drive encrypted without TPM and USB stick, from windows 7, [check procedure here](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the day: Bitlocker without TMP or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From 306ff6e371a1c754c53f3d7408fe4b76ba3e5c00 Mon Sep 17 00:00:00 2001 From: Jose Gabriel Ortega Castro Date: Sat, 14 Sep 2019 10:07:39 -0500 Subject: [PATCH 09/57] Update windows/security/information-protection/bitlocker/bitlocker-overview.md Co-Authored-By: Joyce Y. <47188252+mypil@users.noreply.github.com> --- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index b15072b8b2..f2b5d2dd20 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -61,7 +61,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. > [!IMPORTANT] -> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the day: Bitlocker without TMP or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. From e44c1292b78094f2b875b549b5f1311e69536e85 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Sep 2019 18:00:16 -0700 Subject: [PATCH 10/57] Added content --- .../client-management/mdm/policy-csp-audit.md | 1348 +++++++++++++---- 1 file changed, 1055 insertions(+), 293 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 08e3891e5b..0132b893ca 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -1,12 +1,12 @@ --- title: Policy CSP - Audit description: Policy CSP - Audit -ms.author: Heidi.Lohr +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: Heidilohr -ms.date: 08/13/2019 +author: manikadhiman +ms.date: 09/19/2019 --- # Policy CSP - Audit @@ -245,9 +245,23 @@ If you configure this policy setting, an audit event is generated when an accoun Logon events are essential for understanding user activity and to detect potential attacks. - - +Volume: Low. + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -299,9 +313,22 @@ This policy allows you to audit the group memberhsip information in the user's l When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -354,9 +381,23 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. - - +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -409,9 +450,22 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. +Volume: High. - + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -464,9 +518,22 @@ This policy setting allows you to audit events generated by Internet Key Exchang If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. +Volume: High. - + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -519,9 +586,22 @@ This policy setting allows you to audit events generated by the closing of a log If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. +Volume: Low. - + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -570,15 +650,31 @@ If you do not configure this policy setting, no audit event is generated when a This policy setting allows you to audit events generated by user account logon attempts on the computer. -Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. - Failed logon attempts. - Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. - Security identifiers (SIDs) were filtered and not allowed to log on. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: Success. + +Default on Server editions: Success, Failure. @@ -630,9 +726,22 @@ This policy setting allows you to audit events generated by RADIUS (IAS) and Net If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. +Volume: Medium or High on NPS and IAS server. No volume on other computers. - + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -680,19 +789,32 @@ If you do not configure this policy settings, IAS and NAP user access requests a -This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. - Invoking a screen saver. - Dismissal of a screen saver. - Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. - Access to a wireless network granted to a user or computer account. - Access to a wired 802.1x network granted to a user or computer account. +This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -740,13 +862,26 @@ This policy setting allows you to audit other logon/logoff-related events that a -This policy setting allows you to audit events generated by special logons such as the following : - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). +This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +Volume: Low. - + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -800,9 +935,22 @@ User claims are added to a logon token when claims are included with a user's ac When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. +Volume: Low on a client computer. Medium on a domain controller or a network server. - + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -854,9 +1002,24 @@ This policy setting allows you to audit events generated by validation tests on Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. +Volume: High on domain controllers. - + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -909,9 +1072,24 @@ This policy setting allows you to audit events generated by Kerberos authenticat If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. +Volume: High on Kerberos Key Distribution Center servers. - + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing + +Default on Server editions: Success. @@ -964,9 +1142,24 @@ This policy setting allows you to audit events generated by Kerberos authenticat If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. +Volume: Low. - + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1019,8 +1212,20 @@ This policy setting allows you to audit events generated by responses to credent Currently, there are no events in this subcategory. - + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1068,16 +1273,29 @@ Currently, there are no events in this subcategory. -This policy setting allows you to audit events generated by changes to application groups such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. +This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an application group changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1130,9 +1348,24 @@ This policy setting allows you to audit events generated by changes to computer If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1180,19 +1413,33 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit events generated by changes to distribution groups such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. +This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a distribution group changes. -Note: Events in this subcategory are logged only on domain controllers. +> [!Note] +> Events in this subcategory are logged only on domain controllers. +Volume: Low. - + +GP Info: +- GP English name: *Audit Distributio Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1240,16 +1487,32 @@ Note: Events in this subcategory are logged only on domain controllers. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: +This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy -Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1297,17 +1560,30 @@ Computer Configuration\Windows Settings\Security Settings\Account Policies\Accou -This policy setting allows you to audit events generated by changes to security groups such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. +This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a security group changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -1355,19 +1631,34 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. - A security identifier (SID) is added to the SID History of a user account. - The Directory Services Restore Mode password is configured. - Permissions on administrative user accounts are changed. - Credential Manager credentials are backed up or restored. +This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. -If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -1417,9 +1708,23 @@ If you configure this policy setting, an audit event is generated when an attemp This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. - - +Volume: High. + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1473,9 +1778,24 @@ Only AD DS objects with a matching system access control list (SACL) are logged. Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. +Volume: High on domain controllers. None on client computers. - + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default on Client editions: No Auditing. + +Default on Server editions: Success. @@ -1529,14 +1849,28 @@ When possible, events logged in this subcategory indicate the old and new values Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. -Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. +Volume: High on domain controllers only. - + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing @@ -1589,9 +1923,25 @@ This policy setting allows you to audit replication between two Active Directory If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. - - +>[!Note] +> Events in this subcategory are logged only on domain controllers. +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1644,9 +1994,20 @@ This policy setting allows you to audit events generated when encryption or decr If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. +Volume: Low. - + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1699,9 +2060,20 @@ This policy setting allows you to audit when plug and play detects an external d If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. +Volume: Low. - + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1754,9 +2126,20 @@ This policy setting allows you to audit events generated when a process is creat If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. +Volume: Depends on how the computer is used. - + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1809,9 +2192,20 @@ This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. +Volume: Depends on how the computer is used. - + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1864,9 +2258,20 @@ This policy setting allows you to audit inbound remote procedure call (RPC) conn If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. +Volume: High on RPC servers. - + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -1916,9 +2321,22 @@ If you do not configure this policy setting, no audit event is generated when a This policy setting allows you to audit events generated by adjusting the privileges of a token. +Volume: High. - + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -1967,15 +2385,26 @@ This policy setting allows you to audit events generated by adjusting the privil This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. -Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. - Initialization of an application client context. - Other application operations using the Windows Auditing APIs. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. +Volume: Depends on the applications that are generating them. - + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2025,17 +2454,29 @@ Events in this subcategory include: This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. -If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: -1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. -2) Failure audits when configured records access attempts when: - a) The current central access policy does not grant access but the proposed policy grants access. - b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. - + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2084,27 +2525,38 @@ Volume: Potentially high on a file server when the proposed policy differs signi This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. -AD CS operations include the following: - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. - Issuing of a certificate. - Revocation of a certificate. - Changes to the Certificate Manager settings for AD CS. - Changes in the configuration of AD CS. - Changes to a Certificate Services template. - Importing of a certificate. - Publishing of a certification authority certificate is to Active Directory Domain Services. - Changes to the security permissions for AD CS. - Archival of a key. - Importing of a key. - Retrieval of a key. - Starting of Online Certificate Status Protocol (OCSP) Responder Service. - Stopping of Online Certificate Status Protocol (OCSP) Responder Service. +AD CS operations include the following: +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. +Volume: Medium or Low on computers running Active Directory Certificate Services. - + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2156,11 +2608,23 @@ This policy setting allows you to audit attempts to access files and folders on If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. - + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2212,11 +2676,23 @@ This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. - + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2269,11 +2745,23 @@ This policy setting allows you to audit user attempts to access file system obje If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. -Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. +Volume: Depends on how the file system SACLs are configured. - + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2321,23 +2809,36 @@ Note: You can set a SACL on a file system object using the Security tab in that -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits a bind to a local port. - The WFP blocks a bind to a local port. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits an application or service to listen on a port for incoming connections. - The WFP blocks an application or service to listen on a port for incoming connections. +This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. +Volume: High. - + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2387,9 +2888,21 @@ If you do not configure this policy setting, no audit event is generated when co This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). - - +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2442,11 +2955,23 @@ This policy setting allows you to audit events generated when a handle to an obj If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. -Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. +Volume: Depends on how SACLs are configured. - + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2497,11 +3022,23 @@ Note: Events in this subcategory generate events only for object types where the This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. -Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. +Volume: High if auditing access of global system objects is enabled. - + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2550,20 +3087,32 @@ Note: The Audit: Audit the access of global system objects policy setting contro This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. -For scheduler jobs, the following are audited: - Job created. - Job deleted. - Job enabled. - Job disabled. - Job updated. -For COM+ objects, the following are audited: - Catalog object added. - Catalog object updated. - Catalog object deleted. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2616,11 +3165,23 @@ This policy setting allows you to audit attempts to access registry objects. A s If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. -Note: You can set a SACL on a registry object using the Permissions dialog box. +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. +Volume: Depends on how registry SACLs are configured. - + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2675,8 +3236,18 @@ If you configure this policy setting, an audit event is generated each time an a If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. - + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2725,20 +3296,34 @@ If you do not configure this policy setting, no audit event is generated when an This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. -SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. - SAM_USER – A user account. - SAM_DOMAIN – A domain. - SAM_SERVER – A computer account. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. -Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. -Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). - + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -2786,27 +3371,41 @@ Volume: High on domain controllers. For information about reducing the amount of -This policy setting allows you to audit events generated by changes to the authentication policy such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. - Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. - Granting of any of the following user rights to a user or group: - Access This Computer From the Network. - Allow Logon Locally. - Allow Logon Through Terminal Services. - Logon as a Batch Job. - Logon a Service. - Namespace collision. For example, when a new trust has the same name as an existing namespace name. +This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. -Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. +Volume: Low. - + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -2854,19 +3453,32 @@ Note: The security audit event is logged when the group policy is applied. It do -This policy setting allows you to audit events generated by changes to the authorization policy such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. - Changes to the Resource attributes of an object. - Changes to the Central Access Policy (CAP) applied to an object. +This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when the authorization policy changes. +Volume: Low. - + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2914,18 +3526,31 @@ If you do not configure this policy setting, no audit event is generated when th -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. - Changes to WFP providers and engine. +This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. +Volume: Low. - + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -2973,20 +3598,34 @@ If you do not configure this policy setting, no audit event is generated when a -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. - Changes to Windows Firewall exception list. - Changes to Windows Firewall settings. - Rules ignored or not applied by Windows Firewall Service. - Changes to Windows Firewall Group Policy settings. +This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. +Volume: Low. - + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3034,17 +3673,30 @@ If you do not configure this policy setting, no audit event is generated by chan -This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. - Cryptographic context operations or modifications. - Applied Central Access Policies (CAPs) changes. - Boot Configuration Data (BCD) modifications. +This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3092,21 +3744,35 @@ This policy setting allows you to audit events generated by other security polic -This policy setting allows you to audit changes in the security audit policy settings such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. - De-registration of security event sources. - Changes to the per-user audit settings. - Changes to the value of CrashOnAuditFail. - Changes to the system access control list on a file system or registry object. - Changes to the Special Groups list. +This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. -Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. +Volume: Low. - + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -3155,45 +3821,55 @@ Note: System access control list (SACL) change auditing is done when a SACL for This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). -The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. - Add workstations to domain. - Adjust memory quotas for a process. - Allow log on locally. - Allow log on through Terminal Services. - Bypass traverse checking. - Change the system time. - Create a pagefile. - Create global objects. - - Create permanent shared objects. - Create symbolic links. - Deny access this computer from the network. - Deny log on as a batch job. - Deny log on as a service. - Deny log on locally. - Deny log on through Terminal Services. - Force shutdown from a remote system. - Increase a process working set. - Increase scheduling priority. - Lock pages in memory. - Log on as a batch job. - Log on as a service. - Modify an object label. - Perform volume maintenance tasks. - Profile single process. - Profile system performance. - Remove computer from docking station. - Shut down the system. - Synchronize directory service data. +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. +Volume: Very High. - + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3244,8 +3920,18 @@ If you do not configure this policy setting, no audit event is generated when a Not used. - + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3293,30 +3979,40 @@ Not used. -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. - Back up files and directories. - Create a token object. - Debug programs. - Enable computer and user accounts to be trusted for delegation. - Generate security audits. - Impersonate a client after authentication. - Load and unload device drivers. - Manage auditing and security log. - Modify firmware environment values. - Replace a process-level token. - Restore files and directories. - Take ownership of files or other objects. +This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. - +Volume: High. - + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure @@ -3364,20 +4060,33 @@ If you do not configure this policy setting, no audit event is generated when se -This policy setting allows you to audit events generated by the IPsec filter driver such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. - Network packets dropped due to being in plaintext. - Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. - Inability to process IPsec filters. +This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. +Volume: Low. - + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3425,14 +4134,27 @@ If you do not configure this policy setting, no audit event is generated on an I -This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. +This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. +Volume: Low. - + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -3480,14 +4202,27 @@ This policy setting allows you to audit any of the following events: -This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. +This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. +Volume: Low. - + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success. @@ -3535,15 +4270,29 @@ This policy setting allows you to audit events generated by changes in the secur -This policy setting allows you to audit events related to security system extensions or services such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. - + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: No Auditing. @@ -3591,16 +4340,29 @@ If you do not configure this policy setting, no audit event is generated when an -This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. - The detection of a hash value of an executable file that is not valid as determined by Code Integrity. - Cryptographic operations that compromise system integrity. +This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. +Volume: Low. - + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + +Default: Success, Failure. @@ -3611,7 +4373,7 @@ This policy setting allows you to audit events that violate the integrity of the
-Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. From 46faa86cd9c4317526fc573af2ef7af37dfb6146 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Sep 2019 18:24:44 -0700 Subject: [PATCH 11/57] minor update --- windows/client-management/mdm/policy-csp-audit.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 0132b893ca..7f3ffd9290 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -14,7 +14,6 @@ ms.date: 09/19/2019 > [!WARNING] > Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
From 076bcf2c3f2e023c3f2ed0e14c9352cad44041fa Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 20 Sep 2019 14:14:51 -0700 Subject: [PATCH 12/57] Added "..major release of Windows 10" for 20H1 --- .../mdm/policy-csp-textinput.md | 68 +++++++++---------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index e98340386d..348e974246 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/09/2018 +ms.date: 09/20/2019 ms.reviewer: manager: dansimp --- @@ -14,7 +14,7 @@ manager: dansimp # Policy CSP - TextInput > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
@@ -733,10 +733,10 @@ This setting supports a range of values between 0 and 1. cross mark - check mark8 - check mark8 - check mark8 - check mark8 + check mark + check mark + check mark + check mark cross mark cross mark @@ -757,15 +757,15 @@ This setting supports a range of values between 0 and 1. > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in 20H1. Allows IT admins to configure the Microsoft Simplified Chinese IME version in the desktop. +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. The following list shows the supported values: -- 0 (default) - Allows you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. -- 1 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. -- 2 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. +- 0 (default) - Allows you to configure Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. +- 1 - Does not allow you to configure Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. +- 2 - Does not allow you to configure Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. @@ -788,10 +788,10 @@ The following list shows the supported values: cross mark - check mark8 - check mark8 - check mark8 - check mark8 + check mark + check mark + check mark + check mark cross mark cross mark @@ -812,15 +812,15 @@ The following list shows the supported values: > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in 20H1. Allows IT admins to configure the Microsoft Traditional Chinese IME version in the desktop. +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. The following list shows the supported values: -- 0 (default) - Allows you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. -- 1 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. -- 2 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. +- 0 (default) - Allows you to configure Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. +- 1 - Does not allow you to configure Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. +- 2 - Does not allow you to configure Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. @@ -843,10 +843,10 @@ The following list shows the supported values: cross mark - check mark8 - check mark8 - check mark8 - check mark8 + check mark + check mark + check mark + check mark cross mark cross mark @@ -867,15 +867,15 @@ The following list shows the supported values: > - The policy is only enforced in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in 20H1. Allows IT admins to configure the Microsoft Japanese IME version in the desktop. +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Japanese IME version in the desktop. The following list shows the supported values: -- 0 (default) - Allows you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. -- 1 - Does not allow you to configure which Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. -- 2 - Does not allow you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. +- 0 (default) - Allows you to configure Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. +- 1 - Does not allow you to configure Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. +- 2 - Does not allow you to configure Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. @@ -898,10 +898,10 @@ The following list shows the supported values: cross mark - check mark8 - check mark8 - check mark8 - check mark8 + check mark + check mark + check mark + check mark cross mark cross mark @@ -922,15 +922,15 @@ The following list shows the supported values: > - This policy is enforced only in Windows 10 for desktop. > - This policy requires reboot to take effect. -Added in 20H1. Allows IT admins to configure the Microsoft Korean IME version in the desktop. +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Korean IME version in the desktop. The following list shows the supported values: -- 0 (default) - Allows you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. -- 1 - Does not allow you to configure which Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. -- 2 - Does not allow you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. +- 0 (default) - Allows you to configure Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. +- 1 - Does not allow you to configure Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. +- 2 - Does not allow you to configure Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. From bfd36e1a92a5cbf9121eb4435e40e2d37993440c Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 20 Sep 2019 14:41:29 -0700 Subject: [PATCH 13/57] Sorted the list --- .../mdm/policy-csp-textinput.md | 247 +++++++++--------- 1 file changed, 123 insertions(+), 124 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 348e974246..c0a3ba953c 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -59,19 +59,19 @@ manager: dansimp
TextInput/AllowLinguisticDataCollection
+
+ TextInput/ConfigureJapaneseIMEVersion +
+
+ TextInput/ConfigureKoreanIMEVersion +
TextInput/ConfigureSimplifiedChineseIMEVersion
TextInput/ConfigureTraditionalChineseIMEVersion
-
- TextInput/ConfigureJapaneseIMEVersion -
-
- TextInput/ConfigureKoreanIMEVersion -
-
+
TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
@@ -716,117 +716,6 @@ This setting supports a range of values between 0 and 1.
- - -**TextInput/ConfigureSimplifiedChineseIMEVersion** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> - This policy is enforced only in Windows 10 for desktop. -> - This policy requires reboot to take effect. - -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. - - - -The following list shows the supported values: - -- 0 (default) - Allows you to configure Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. -- 1 - Does not allow you to configure Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. -- 2 - Does not allow you to configure Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. - - - - -
- - -**TextInput/ConfigureTraditionalChineseIMEVersion** - - - - - - - - - - - - - - - - - - - - - -
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
- - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> - This policy is enforced only in Windows 10 for desktop. -> - This policy requires reboot to take effect. - -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. - - - -The following list shows the supported values: - -- 0 (default) - Allows you to configure Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. -- 1 - Does not allow you to configure Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. -- 2 - Does not allow you to configure Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. - - - - -
- **TextInput/ConfigureJapaneseIMEVersion** @@ -873,9 +762,9 @@ Added in next major release of Windows 10. Allows IT admins to configure Microso The following list shows the supported values: -- 0 (default) - Allows you to configure Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. -- 1 - Does not allow you to configure Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. -- 2 - Does not allow you to configure Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. +- 0 (default) - Allows you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. @@ -928,9 +817,119 @@ Added in next major release of Windows 10. Allows IT admins to configure Microso The following list shows the supported values: -- 0 (default) - Allows you to configure Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. -- 1 - Does not allow you to configure Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. -- 2 - Does not allow you to configure Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. +- 0 (default) - Allows you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. +- 2 - Does not allow you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. + + + + +
+ + +**TextInput/ConfigureSimplifiedChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. + + + + +
+ + +**TextInput/ConfigureTraditionalChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck markcheck markcheck markcheck markcross markcross mark
+ + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. From 80896e56afb5997b14b1af76ce4dbcb6ab6c7147 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 20 Sep 2019 15:21:50 -0700 Subject: [PATCH 14/57] minor update --- windows/client-management/mdm/policy-csp-textinput.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index c0a3ba953c..14e526875c 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -716,6 +716,7 @@ This setting supports a range of values between 0 and 1.
+ **TextInput/ConfigureJapaneseIMEVersion** @@ -993,6 +994,7 @@ The following list shows the supported values:
+ **TextInput/ExcludeJapaneseIMEExceptJIS0208** From 986b4242e822278de38474d83d71e21f285518a6 Mon Sep 17 00:00:00 2001 From: Robert Mazzoli Date: Mon, 23 Sep 2019 07:01:03 -0700 Subject: [PATCH 15/57] Changed loc prioritization per Tina --- devices/hololens/hololens-status.md | 2 +- devices/surface-hub/index.md | 2 +- devices/surface/get-started.md | 2 +- devices/surface/index.md | 2 +- devices/surface/surface-wireless-connect.md | 2 +- mdop/mbam-v25/upgrade-mbam2.5-sp1.md | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/hololens/hololens-status.md b/devices/hololens/hololens-status.md index 60289bad05..21264d1d3e 100644 --- a/devices/hololens/hololens-status.md +++ b/devices/hololens/hololens-status.md @@ -8,7 +8,7 @@ manager: jarrettr audience: Admin ms.topic: article ms.prod: hololens -localization_priority: Medium +ms.localizationpriority: Medium ms.sitesec: library --- diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index 6d0b532210..110355baf4 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -9,7 +9,7 @@ ms.tgt_pltfrm: na ms.devlang: na ms.topic: landing-page description: "Get started with Microsoft Surface Hub." -localization_priority: High +ms.localizationpriority: High --- # Get started with Surface Hub diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md index 658d59d971..3e5de94680 100644 --- a/devices/surface/get-started.md +++ b/devices/surface/get-started.md @@ -10,7 +10,7 @@ ms.tgt_pltfrm: na ms.devlang: na ms.topic: landing-page description: "Get started with Microsoft Surface devices" -localization_priority: High +ms.localizationpriority: High --- # Get started with Surface devices diff --git a/devices/surface/index.md b/devices/surface/index.md index 8a40146adb..2677bffc49 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -8,7 +8,7 @@ ms.author: robmazz manager: laurawi ms.topic: hub-page keywords: Microsoft Surface, Microsoft Surface Hub, Surface documentation -localization_priority: High +ms.localizationpriority: High audience: ITPro ms.prod: Surface description: Learn about Microsoft Surface and Surface Hub devices. diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md index cad2a6924f..c8b1b592de 100644 --- a/devices/surface/surface-wireless-connect.md +++ b/devices/surface/surface-wireless-connect.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library author: dansimp ms.audience: itpro -ms.localization_priority: normal +ms.ms.localizationpriority: normal ms.author: dansimp ms.topic: article ms.date: 08/15/2019 diff --git a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md index cd80095b3e..c9f0e46454 100644 --- a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md +++ b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md @@ -7,7 +7,7 @@ audience: ITPro ms.topic: article ms.prod: w10 manager: miaposto -localization_priority: Normal +ms.localizationpriority: Normal --- # Upgrade from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update From 6cc47dc5bb19733a44aa59a48bd45605477e7f30 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 13:12:58 -0700 Subject: [PATCH 16/57] Added dev comments --- .../client-management/mdm/policy-csp-audit.md | 760 ++++++++---------- 1 file changed, 357 insertions(+), 403 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 7f3ffd9290..5d5b50ce4d 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 09/19/2019 +ms.date: 09/24/2019 --- # Policy CSP - Audit @@ -218,10 +218,10 @@ ms.date: 09/19/2019 cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -238,7 +238,7 @@ ms.date: 09/19/2019 -This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -256,11 +256,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -288,10 +287,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -308,7 +307,7 @@ Default: Success. -This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. @@ -322,12 +321,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -355,10 +353,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -375,7 +373,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -391,12 +389,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -424,10 +421,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -444,7 +441,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -459,12 +456,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -492,10 +488,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -512,7 +508,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -527,12 +523,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -560,10 +555,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -580,7 +575,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -596,11 +591,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -628,10 +622,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -648,7 +642,7 @@ Default: Success. -This policy setting allows you to audit events generated by user account logon attempts on the computer. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. @@ -667,13 +661,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default on Client editions) — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default on Server editions) — Success+Failure -Default on Client editions: Success. - -Default on Server editions: Success, Failure. @@ -701,10 +692,10 @@ Default on Server editions: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -721,7 +712,7 @@ Default on Server editions: Success, Failure. -This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -768,10 +759,10 @@ Default: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -788,7 +779,7 @@ Default: Success, Failure. -This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. @@ -808,12 +799,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -841,10 +831,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -861,7 +851,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by special logons, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). @@ -876,11 +866,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -908,10 +897,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -928,7 +917,7 @@ Default: Success. -This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Available in Windows 10, version 1803 and later. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. @@ -944,12 +933,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -977,10 +965,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -997,7 +985,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by validation tests on user account logon credentials. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. @@ -1011,14 +999,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1046,10 +1031,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1066,7 +1051,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -1081,14 +1066,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing - -Default on Server editions: Success. @@ -1116,10 +1098,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1136,7 +1118,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -1151,14 +1133,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1186,10 +1165,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1206,7 +1185,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. @@ -1219,12 +1198,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1252,10 +1230,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1272,7 +1250,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to application groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to application groups, such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. @@ -1289,12 +1267,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1322,10 +1299,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1342,7 +1319,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1357,14 +1334,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1392,10 +1366,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1412,7 +1386,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. @@ -1433,12 +1407,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1466,10 +1439,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1486,7 +1459,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: @@ -1506,12 +1479,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1539,10 +1511,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1559,7 +1531,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to security groups, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to security groups, such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. @@ -1578,11 +1550,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1610,10 +1581,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1630,7 +1601,7 @@ Default: Success. -This policy setting allows you to audit changes to user accounts. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. @@ -1653,11 +1624,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -1685,10 +1655,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1705,7 +1675,7 @@ Default: Success. -This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. @@ -1718,12 +1688,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1751,10 +1720,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1771,7 +1740,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. @@ -1787,14 +1756,11 @@ GP Info: The following are the supported values: -- 0 — Off/None -- 1 — Success +- 0 (default on Client editions) — Off/None +- 1 (default on Server editions) — Success - 2 — Failure - 3 — Success+Failure -Default on Client editions: No Auditing. - -Default on Server editions: Success. @@ -1822,10 +1788,10 @@ Default on Server editions: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1842,7 +1808,7 @@ Default on Server editions: Success. -This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. @@ -1864,12 +1830,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing @@ -1897,10 +1862,10 @@ Default: No Auditing cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1917,7 +1882,7 @@ Default: No Auditing -This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -1935,12 +1900,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -1968,10 +1932,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -1988,7 +1952,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -2003,7 +1967,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2034,10 +1998,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2054,7 +2018,7 @@ The following are the supported values: -This policy setting allows you to audit when plug and play detects an external device. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -2069,7 +2033,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2100,10 +2064,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2120,7 +2084,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. @@ -2135,7 +2099,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2166,10 +2130,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2186,7 +2150,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a process ends. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. @@ -2232,10 +2196,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2252,7 +2216,7 @@ The following are the supported values: -This policy setting allows you to audit inbound remote procedure call (RPC) connections. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -2267,7 +2231,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2298,10 +2262,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2318,7 +2282,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by adjusting the privileges of a token. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. @@ -2330,12 +2294,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2363,10 +2326,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2383,7 +2346,7 @@ Default: No Auditing. -This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. @@ -2400,7 +2363,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2431,10 +2394,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2451,7 +2414,7 @@ The following are the supported values: -This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. @@ -2470,12 +2433,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -2503,10 +2465,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2523,8 +2485,9 @@ Default: No Auditing. -This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: + - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. @@ -2552,7 +2515,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2583,10 +2546,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2603,7 +2566,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2620,7 +2583,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2651,10 +2614,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2671,7 +2634,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access a shared folder. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2688,7 +2651,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2719,10 +2682,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2739,7 +2702,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. @@ -2757,7 +2720,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2788,10 +2751,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2808,7 +2771,7 @@ The following are the supported values: -This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. @@ -2834,7 +2797,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2865,10 +2828,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2885,7 +2848,7 @@ The following are the supported values: -This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High. @@ -2898,7 +2861,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2929,10 +2892,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -2949,7 +2912,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. @@ -2967,7 +2930,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -2998,10 +2961,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3018,7 +2981,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] @@ -3034,7 +2997,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3065,10 +3028,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3085,7 +3048,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: - Job created. - Job deleted. @@ -3108,7 +3071,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3139,10 +3102,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3159,7 +3122,7 @@ The following are the supported values: -This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. @@ -3177,7 +3140,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3208,10 +3171,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3228,7 +3191,7 @@ The following are the supported values: -This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -3243,7 +3206,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3274,10 +3237,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3294,7 +3257,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. @@ -3319,7 +3282,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3350,10 +3313,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3370,7 +3333,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. @@ -3400,11 +3363,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3432,10 +3394,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3452,7 +3414,7 @@ Default: Success. -This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. @@ -3472,12 +3434,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3505,10 +3466,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3525,7 +3486,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. @@ -3544,12 +3505,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3577,10 +3537,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3597,7 +3557,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. @@ -3619,12 +3579,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3652,10 +3611,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3672,7 +3631,7 @@ Default: No Auditing. -This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. @@ -3690,12 +3649,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -3723,10 +3681,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3743,7 +3701,7 @@ Default: No Auditing. -This policy setting allows you to audit changes in the security audit policy settings, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes in the security audit policy settings, such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. @@ -3767,11 +3725,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -3799,10 +3756,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3819,7 +3776,7 @@ Default: Success. -This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. @@ -3865,7 +3822,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3896,10 +3853,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3927,7 +3884,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -3958,10 +3915,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -3978,7 +3935,7 @@ The following are the supported values: -This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. @@ -4008,7 +3965,7 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure @@ -4039,10 +3996,10 @@ The following are the supported values: cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4059,7 +4016,7 @@ The following are the supported values: -This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. @@ -4080,12 +4037,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4113,10 +4069,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4133,7 +4089,7 @@ Default: No Auditing. -This policy setting allows you to audit any of the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. @@ -4181,10 +4137,10 @@ Default: Success, Failure. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4201,7 +4157,7 @@ Default: Success, Failure. -This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. @@ -4217,11 +4173,10 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 — Success +- 1 (default) — Success - 2 — Failure - 3 — Success+Failure -Default: Success. @@ -4249,10 +4204,10 @@ Default: Success. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4269,7 +4224,7 @@ Default: Success. -This policy setting allows you to audit events related to security system extensions or services, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events related to security system extensions or services, such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. @@ -4286,12 +4241,11 @@ GP Info: The following are the supported values: -- 0 — Off/None +- 0 (default) — Off/None - 1 — Success - 2 — Failure - 3 — Success+Failure -Default: No Auditing. @@ -4319,10 +4273,10 @@ Default: No Auditing. cross mark - check mark6 - check mark6 - check mark6 - check mark6 + check mark + check mark + check mark + check mark @@ -4339,7 +4293,7 @@ Default: No Auditing. -This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +Available in Windows 10, version 1803 and later. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. From 2fda7f01a808b1cbffd0153ebf09a15b18fb5806 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 14:03:53 -0700 Subject: [PATCH 17/57] Updated Policy index page with audit policies --- .../policy-configuration-service-provider.md | 182 ++++++++++++++++++ 1 file changed, 182 insertions(+) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..914bf6b9a3 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -343,6 +343,188 @@ The following diagram shows the Policy configuration service provider in tree fo
+### Audit policies + +
+
+ Audit/AccountLogonLogoff_AuditAccountLockout +
+
+ Audit/AccountLogonLogoff_AuditGroupMembership +
+
+ Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecMainMode +
+
+ Audit/AccountLogonLogoff_AuditIPsecQuickMode +
+
+ Audit/AccountLogonLogoff_AuditLogoff +
+
+ Audit/AccountLogonLogoff_AuditLogon +
+
+ Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
+
+ Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
+
+ Audit/AccountLogonLogoff_AuditSpecialLogon +
+
+ Audit/AccountLogonLogoff_AuditUserDeviceClaims +
+
+ Audit/AccountLogon_AuditCredentialValidation +
+
+ Audit/AccountLogon_AuditKerberosAuthenticationService +
+
+ Audit/AccountLogon_AuditKerberosServiceTicketOperations +
+
+ Audit/AccountLogon_AuditOtherAccountLogonEvents +
+
+ Audit/AccountManagement_AuditApplicationGroupManagement +
+
+ Audit/AccountManagement_AuditComputerAccountManagement +
+
+ Audit/AccountManagement_AuditDistributionGroupManagement +
+
+ Audit/AccountManagement_AuditOtherAccountManagementEvents +
+
+ Audit/AccountManagement_AuditSecurityGroupManagement +
+
+ Audit/AccountManagement_AuditUserAccountManagement +
+
+ Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
+
+ Audit/DSAccess_AuditDirectoryServiceAccess +
+
+ Audit/DSAccess_AuditDirectoryServiceChanges +
+
+ Audit/DSAccess_AuditDirectoryServiceReplication +
+
+ Audit/DetailedTracking_AuditDPAPIActivity +
+
+ Audit/DetailedTracking_AuditPNPActivity +
+
+ Audit/DetailedTracking_AuditProcessCreation +
+
+ Audit/DetailedTracking_AuditProcessTermination +
+
+ Audit/DetailedTracking_AuditRPCEvents +
+
+ Audit/DetailedTracking_AuditTokenRightAdjusted +
+
+ Audit/ObjectAccess_AuditApplicationGenerated +
+
+ Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
+
+ Audit/ObjectAccess_AuditCertificationServices +
+
+ Audit/ObjectAccess_AuditDetailedFileShare +
+
+ Audit/ObjectAccess_AuditFileShare +
+
+ Audit/ObjectAccess_AuditFileSystem +
+
+ Audit/ObjectAccess_AuditFilteringPlatformConnection +
+
+ Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
+
+ Audit/ObjectAccess_AuditHandleManipulation +
+
+ Audit/ObjectAccess_AuditKernelObject +
+
+ Audit/ObjectAccess_AuditOtherObjectAccessEvents +
+
+ Audit/ObjectAccess_AuditRegistry +
+
+ Audit/ObjectAccess_AuditRemovableStorage +
+
+ Audit/ObjectAccess_AuditSAM +
+
+ Audit/PolicyChange_AuditAuthenticationPolicyChange +
+
+ Audit/PolicyChange_AuditAuthorizationPolicyChange +
+
+ Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
+
+ Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
+
+ Audit/PolicyChange_AuditOtherPolicyChangeEvents +
+
+ Audit/PolicyChange_AuditPolicyChange +
+
+ Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
+
+ Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
+
+ Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
+
+ Audit/System_AuditIPsecDriver +
+
+ Audit/System_AuditOtherSystemEvents +
+
+ Audit/System_AuditSecurityStateChange +
+
+ Audit/System_AuditSecuritySystemExtension +
+
+ Audit/System_AuditSystemIntegrity +
+
+ ### Authentication policies
From ccfcf4c8853afe12b8dd157fe72ebe4e3d5542d0 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:00:58 -0700 Subject: [PATCH 18/57] Update prevent-changes-to-security-settings-with-tamper-protection.md --- ...nges-to-security-settings-with-tamper-protection.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 5ba3f228c0..accb73651d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -46,9 +46,9 @@ Tamper Protection doesn't prevent you from viewing your security settings. And, ### What do you want to do? -[Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine) +[Turn Tamper Protection on (or off) for an individual machine using Windows Security](#turn-tamper-protection-on-or-off-for-an-individual-machine) -[Turn Tamper Protection on (or off) for your organization with Intune (Preview)](#turn-tamper-protection-on-or-off-for-your-organization-with-intune) +[Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune) ## Turn Tamper Protection on (or off) for an individual machine @@ -68,11 +68,9 @@ If you are a home user, or you are not subject to settings managed by a security > Once you’ve made this update, Tamper Protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors. -## Turn Tamper Protection on (or off) for your organization with Intune +## Turn Tamper Protection on (or off) for your organization using Intune -If you are part of your organization's security team, the ability to turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune) is now in preview. "In preview" means this feature is rolling out to business customers who have [Microsoft Defender ATP](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) and who have agreed to participate in the preview program. As a preview feature, the following applies: - -*Some information in this section relates to prereleased product that might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.* +If you are part of your organization's security team, you can turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). (This feature is rolling out now; if you don't have it yet, you should very soon, assuming your organization has [Microsoft Defender ATP](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) and that you meet the prerequisites listed below.) You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task. From 59ca5ce7ed22f02700088e0de33c266e1b31c0a3 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:28:12 -0700 Subject: [PATCH 19/57] tamper protect is going GA --- .../threat-protection/microsoft-defender-atp/preview.md | 2 -- .../whats-new-in-microsoft-defender-atp.md | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index a3780835a9..692f8cc37b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -46,8 +46,6 @@ The following features are included in the preview release: - [API Explorer](api-explorer.md)
The API explorer makes it easy to construct and perform API queries, test and send requests for any available Microsoft Defender ATP API endpoint. -- [Tamper Protection settings in Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-with-intune)
You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). - - [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation. - [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
You can now allow or block URLs/domains using your own threat intelligence. diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index f8f068cd50..ab3f057835 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -30,6 +30,9 @@ For more information preview features, see [Preview features](https://docs.micro ## September 2019 + +- [Tamper Protection settings in Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-with-intune)
You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). + - [Live response](live-response.md)
Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats - real-time. - [Evaluation lab](evaluation-lab.md)
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can From 1b077f67647fddde9538ab6f203df81dc9cfcdc0 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:42:17 -0700 Subject: [PATCH 20/57] Update whats-new-in-microsoft-defender-atp.md --- .../whats-new-in-microsoft-defender-atp.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index ab3f057835..871d20ad03 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -25,7 +25,6 @@ ms.topic: conceptual The following features are generally available (GA) in the latest release of Microsoft Defender ATP as well as security features in Windows 10 and Windows Server. - For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection). From d4b75fc850b564a8c50f3fcdb856ac2be25c2dff Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:45:58 -0700 Subject: [PATCH 21/57] Update configure-endpoints-non-windows.md --- .../configure-endpoints-non-windows.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 7da16a125c..82211561cf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -1,6 +1,6 @@ --- title: Onboard non-Windows machines to the Microsoft Defender ATP service -description: Configure non-Winodws machines so that they can send sensor data to the Microsoft Defender ATP service. +description: Configure non-Windows machines so that they can send sensor data to the Microsoft Defender ATP service. keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author macaparas +ms.author: macaparas author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -27,14 +27,10 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) - - Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network. You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. - - ## Onboarding non-Windows machines You'll need to take the following steps to onboard non-Windows machines: 1. Select your preferred method of onboarding: From 01acaf46bb4ce8412732ea8640fe659ddcd55025 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:46:45 -0700 Subject: [PATCH 22/57] Update whats-new-in-microsoft-defender-atp.md --- .../whats-new-in-microsoft-defender-atp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 871d20ad03..be3d95c1f3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -30,7 +30,7 @@ For more information preview features, see [Preview features](https://docs.micro ## September 2019 -- [Tamper Protection settings in Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-with-intune)
You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). +- [Tamper Protection settings using Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-using-intune)
You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). - [Live response](live-response.md)
Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats - real-time. From 97b6ef20fcd5178f31ee845269684a5bb3951ca0 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:47:31 -0700 Subject: [PATCH 23/57] Update prevent-changes-to-security-settings-with-tamper-protection.md --- ...event-changes-to-security-settings-with-tamper-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index accb73651d..0a78bbd6af 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -116,7 +116,7 @@ Tamper Protection will not have any impact on such devices. If you are a home user, see [Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine). -If you are an organization using [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization with Intune](#turn-tamper-protection-on-or-off-for-your-organization-with-intune). +If you are an organization using [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization using Intune](#turn-tamper-protection-on-or-off-for-your-organization-using-intune). ### How does configuring Tamper Protection in Intune affect how I manage Windows Defender through my group policy? From 08fe226a40306be9359ba949c4c85253992cfd7f Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:49:29 -0700 Subject: [PATCH 24/57] Update about-app-v-package-accelerators--app-v-46-sp1-.md --- .../about-app-v-package-accelerators--app-v-46-sp1-.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md index e162df6f9b..638fd0e895 100644 --- a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md +++ b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md @@ -1,11 +1,11 @@ --- title: About App-V Package Accelerators (App-V 4.6 SP1) description: About App-V Package Accelerators (App-V 4.6 SP1) -author: dansimp +author: manikadhiman ms.assetid: fc2d2375-8f17-4a6d-b374-771cb947cb8c ms.reviewer: manager: dansimp -ms.author: manikadhiman +ms.author: v-madhi ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library From af674fded79850722eefc8065d5d8c9d10052687 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:51:19 -0700 Subject: [PATCH 25/57] Update how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md --- ...-an-app-v-46-package-for-all-users-on-a-specific-computer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md index d154228918..d8bed1b729 100644 --- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md +++ b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md @@ -1,5 +1,5 @@ --- -title: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer +title: "How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer" description: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer ms.assetid: 2a43ca1b-6847-4dd1-ade2-336ac4ac6af0 ms.reviewer: From 07007dce5d5fefd183510fcaf8d49c44a20673b4 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:55:22 -0700 Subject: [PATCH 26/57] fixing build report errors --- .../level-1-enterprise-basic-security.md | 2 +- .../level-2-enterprise-enhanced-security.md | 2 +- .../level-3-enterprise-high-security.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md index fe043e036b..bd4027cdd4 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: appcompatguy +ms.author: cjacks author: appcompatguy manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md index 3671675351..f66320e362 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: appcompatguy +ms.author: cjacks author: appcompatguy manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md index d1673ce03b..640af6ba59 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: appcompatguy +ms.author: cjacks author: appcompatguy manager: dansimp audience: ITPro From 324fbbf22ec13cc9f42e3e88cfc382116a4f5d71 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:57:51 -0700 Subject: [PATCH 27/57] Update create-path-based-rules.md --- .../create-path-based-rules.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md index babbce2e0b..44a9846b76 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: mdsakibMSFT +ms.author: mdsakib ms.date: 05/17/2019 --- From cfd37751a28f39fb098a38e7e017923de453def7 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:58:19 -0700 Subject: [PATCH 28/57] Update deploy-multiple-windows-defender-application-control-policies.md --- ...loy-multiple-windows-defender-application-control-policies.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 40326f9ba8..d192ac21a9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: mdsakibMSFT +ms.author: mdsakib ms.date: 05/17/2019 --- From b5469ed6f19f518d193aa2c9b72e35910417ff40 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 15:59:47 -0700 Subject: [PATCH 29/57] Update use-a-reference-computer-to-create-and-maintain-applocker-policies.md --- ...nce-computer-to-create-and-maintain-applocker-policies.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index adf5eb6279..bf87000f78 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,9 +1,6 @@ -ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 -ms.reviewer: --- title: Use a reference device to create and maintain AppLocker policies (Windows 10) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. - ms.author: macapara ms.prod: w10 ms.mktglfcycl: deploy @@ -16,6 +13,8 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/21/2017 +ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 +ms.reviewer: --- # Use a reference device to create and maintain AppLocker policies From 6801774bc1c7c3b9648850037bcb57504d008846 Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 16:01:29 -0700 Subject: [PATCH 30/57] Update allow-com-object-registration-in-windows-defender-application-control-policy.md --- ...egistration-in-windows-defender-application-control-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index 785d80cbcc..c0e0200d21 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -7,6 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: mdsakibMSFT +ms.author: mdsakib ms.date: 05/21/2019 --- From 4ccb84c22303b678964aab09cf3ac71346fc44fe Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 16:03:06 -0700 Subject: [PATCH 31/57] Update user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md --- ...levation-prompt-for-administrators-in-admin-approval-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index acd0f63ec6..9576d05d77 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -4,7 +4,7 @@ description: Describes the best practices, location, values, policy management a ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d ms.reviewer: ms.author: dansimp -ms.prod: ws10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security From 56c31a35cab96e0d5d7fbdd79a60abd5a8735bed Mon Sep 17 00:00:00 2001 From: denisebmsft Date: Tue, 24 Sep 2019 16:04:24 -0700 Subject: [PATCH 32/57] Update tvm-dashboard-insights.md --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index b6571426ba..1704845ac8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -4,6 +4,7 @@ description: What's in the Threat & Vulnerability Management dashboard and how i keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, risk-based threat & vulnerability management, security configuration, configuration score, exposure score search.appverid: met150 search.product: eADQiWindows 10XVcnh +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security From 086d26e3654c4f33bd8439e5eb79d943d53ba4e4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 24 Sep 2019 16:26:34 -0700 Subject: [PATCH 33/57] Updated links --- .../policy-configuration-service-provider.md | 118 +++++++++--------- 1 file changed, 59 insertions(+), 59 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 914bf6b9a3..fe4dd34601 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -347,181 +347,181 @@ The following diagram shows the Policy configuration service provider in tree fo
- Audit/AccountLogonLogoff_AuditAccountLockout + Audit/AccountLogonLogoff_AuditAccountLockout
- Audit/AccountLogonLogoff_AuditGroupMembership + Audit/AccountLogonLogoff_AuditGroupMembership
- Audit/AccountLogonLogoff_AuditIPsecExtendedMode + Audit/AccountLogonLogoff_AuditIPsecExtendedMode
- Audit/AccountLogonLogoff_AuditIPsecMainMode + Audit/AccountLogonLogoff_AuditIPsecMainMode
- Audit/AccountLogonLogoff_AuditIPsecQuickMode + Audit/AccountLogonLogoff_AuditIPsecQuickMode
- Audit/AccountLogonLogoff_AuditLogoff + Audit/AccountLogonLogoff_AuditLogoff
- Audit/AccountLogonLogoff_AuditLogon + Audit/AccountLogonLogoff_AuditLogon
- Audit/AccountLogonLogoff_AuditNetworkPolicyServer + Audit/AccountLogonLogoff_AuditNetworkPolicyServer
- Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents
- Audit/AccountLogonLogoff_AuditSpecialLogon + Audit/AccountLogonLogoff_AuditSpecialLogon
- Audit/AccountLogonLogoff_AuditUserDeviceClaims + Audit/AccountLogonLogoff_AuditUserDeviceClaims
- Audit/AccountLogon_AuditCredentialValidation + Audit/AccountLogon_AuditCredentialValidation
- Audit/AccountLogon_AuditKerberosAuthenticationService + Audit/AccountLogon_AuditKerberosAuthenticationService
- Audit/AccountLogon_AuditKerberosServiceTicketOperations + Audit/AccountLogon_AuditKerberosServiceTicketOperations
- Audit/AccountLogon_AuditOtherAccountLogonEvents + Audit/AccountLogon_AuditOtherAccountLogonEvents
- Audit/AccountManagement_AuditApplicationGroupManagement + Audit/AccountManagement_AuditApplicationGroupManagement
- Audit/AccountManagement_AuditComputerAccountManagement + Audit/AccountManagement_AuditComputerAccountManagement
- Audit/AccountManagement_AuditDistributionGroupManagement + Audit/AccountManagement_AuditDistributionGroupManagement
- Audit/AccountManagement_AuditOtherAccountManagementEvents + Audit/AccountManagement_AuditOtherAccountManagementEvents
- Audit/AccountManagement_AuditSecurityGroupManagement + Audit/AccountManagement_AuditSecurityGroupManagement
- Audit/AccountManagement_AuditUserAccountManagement + Audit/AccountManagement_AuditUserAccountManagement
- Audit/DSAccess_AuditDetailedDirectoryServiceReplication + Audit/DSAccess_AuditDetailedDirectoryServiceReplication
- Audit/DSAccess_AuditDirectoryServiceAccess + Audit/DSAccess_AuditDirectoryServiceAccess
- Audit/DSAccess_AuditDirectoryServiceChanges + Audit/DSAccess_AuditDirectoryServiceChanges
- Audit/DSAccess_AuditDirectoryServiceReplication + Audit/DSAccess_AuditDirectoryServiceReplication
- Audit/DetailedTracking_AuditDPAPIActivity + Audit/DetailedTracking_AuditDPAPIActivity
- Audit/DetailedTracking_AuditPNPActivity + Audit/DetailedTracking_AuditPNPActivity
- Audit/DetailedTracking_AuditProcessCreation + Audit/DetailedTracking_AuditProcessCreation
- Audit/DetailedTracking_AuditProcessTermination + Audit/DetailedTracking_AuditProcessTermination
- Audit/DetailedTracking_AuditRPCEvents + Audit/DetailedTracking_AuditRPCEvents
- Audit/DetailedTracking_AuditTokenRightAdjusted + Audit/DetailedTracking_AuditTokenRightAdjusted
- Audit/ObjectAccess_AuditApplicationGenerated + Audit/ObjectAccess_AuditApplicationGenerated
- Audit/ObjectAccess_AuditCentralAccessPolicyStaging + Audit/ObjectAccess_AuditCentralAccessPolicyStaging
- Audit/ObjectAccess_AuditCertificationServices + Audit/ObjectAccess_AuditCertificationServices
- Audit/ObjectAccess_AuditDetailedFileShare + Audit/ObjectAccess_AuditDetailedFileShare
- Audit/ObjectAccess_AuditFileShare + Audit/ObjectAccess_AuditFileShare
- Audit/ObjectAccess_AuditFileSystem + Audit/ObjectAccess_AuditFileSystem
- Audit/ObjectAccess_AuditFilteringPlatformConnection + Audit/ObjectAccess_AuditFilteringPlatformConnection
- Audit/ObjectAccess_AuditFilteringPlatformPacketDrop + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop
- Audit/ObjectAccess_AuditHandleManipulation + Audit/ObjectAccess_AuditHandleManipulation
- Audit/ObjectAccess_AuditKernelObject + Audit/ObjectAccess_AuditKernelObject
- Audit/ObjectAccess_AuditOtherObjectAccessEvents + Audit/ObjectAccess_AuditOtherObjectAccessEvents
- Audit/ObjectAccess_AuditRegistry + Audit/ObjectAccess_AuditRegistry
- Audit/ObjectAccess_AuditRemovableStorage + Audit/ObjectAccess_AuditRemovableStorage
- Audit/ObjectAccess_AuditSAM + Audit/ObjectAccess_AuditSAM
- Audit/PolicyChange_AuditAuthenticationPolicyChange + Audit/PolicyChange_AuditAuthenticationPolicyChange
- Audit/PolicyChange_AuditAuthorizationPolicyChange + Audit/PolicyChange_AuditAuthorizationPolicyChange
- Audit/PolicyChange_AuditFilteringPlatformPolicyChange + Audit/PolicyChange_AuditFilteringPlatformPolicyChange
- Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange
- Audit/PolicyChange_AuditOtherPolicyChangeEvents + Audit/PolicyChange_AuditOtherPolicyChangeEvents
- Audit/PolicyChange_AuditPolicyChange + Audit/PolicyChange_AuditPolicyChange
- Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse
- Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents
- Audit/PrivilegeUse_AuditSensitivePrivilegeUse + Audit/PrivilegeUse_AuditSensitivePrivilegeUse
- Audit/System_AuditIPsecDriver + Audit/System_AuditIPsecDriver
- Audit/System_AuditOtherSystemEvents + Audit/System_AuditOtherSystemEvents
- Audit/System_AuditSecurityStateChange + Audit/System_AuditSecurityStateChange
- Audit/System_AuditSecuritySystemExtension + Audit/System_AuditSecuritySystemExtension
- Audit/System_AuditSystemIntegrity + Audit/System_AuditSystemIntegrity
From c8e9a1e962ab07a57b4f90ecd29e6412cff0d0a0 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 24 Sep 2019 17:59:14 -0700 Subject: [PATCH 34/57] Add more info around allowed threat management --- .../microsoft-defender-atp-mac-preferences.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index ffa0df06d3..1902cc1a3f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -149,6 +149,16 @@ Used to exclude content from the scan by file name. | **Possible values** | any string | | **Comments** | Applicable only if *$type* is *excludedFileName* | +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + #### Threat type settings The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. @@ -425,7 +435,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings @@ -540,7 +550,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings From ee4c9764b95003a333fd7a4e155920f2434e00e0 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Tue, 24 Sep 2019 19:13:46 -0700 Subject: [PATCH 35/57] CAT Auto Pulish for Windows Release Messages - 20190924190106 (#1194) * Updated supported values for ScheduleScanDay * multiple fixes * More fixes * Fixed typos * Fixed typos * CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190924173922 (#1193) --- ...ew-in-windows-mdm-enrollment-management.md | 23 ++++++--- .../mdm/policy-csp-defender.md | 26 ++++------ .../mdm/policy-csp-kioskbrowser.md | 4 +- .../mdm/policy-csp-lockdown.md | 2 +- .../mdm/policy-csp-privacy.md | 40 +++++++-------- .../mdm/policy-csp-servicecontrolmanager.md | 7 ++- .../client-management/mdm/policy-csp-start.md | 23 ++++----- .../mdm/policy-csp-system.md | 20 ++++---- .../mdm/policy-csp-troubleshooting.md | 14 +++--- .../mdm/policy-csp-update.md | 50 +------------------ .../windows-message-center.yml | 2 +- 11 files changed, 82 insertions(+), 129 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..1c11eca4c1 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -56,6 +56,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [September 2019](#september-2019) - [August 2019](#august-2019) - [July 2019](#july-2019) - [June 2019](#june-2019) @@ -470,7 +471,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -830,7 +831,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam Messaging CSP -

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

    +

    Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

    @@ -940,7 +941,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver

    • Removed TextInput/AllowLinguisticDataCollection

    -

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

    +

    Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

    Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

    Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

    Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

    @@ -1529,7 +1530,7 @@ Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelNam -

    Management tool for the Micosoft Store for Business

    +

    Management tool for the Microsoft Store for Business

    New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

    @@ -1899,6 +1900,12 @@ How do I turn if off? | The service can be stopped from the "Services" console o ## Change history in MDM documentation +### September 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| + ### August 2019 |New or updated topic | Description| @@ -2189,8 +2196,8 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
  • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
  • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
    • -
  • System/AllowFontProviders is not supported in Windows Holographic for Business.
    • -
  • Security/RequireDeviceEncryption is suported in the Home SKU.
    • +
  • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
    • +
  • Security/RequireDeviceEncryption is supported in the Home SKU.
  • Start/StartLayout - added a table of SKU support information.
  • Start/ImportEdgeAssets - added a table of SKU support information.
    • @@ -2424,7 +2431,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o
  • ShellLauncher
  • StatusConfiguration
    • -

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

    +

    Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

    MultiSIM CSP @@ -2739,7 +2746,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o

    For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

    -EntepriseAPN CSP +EnterpriseAPN CSP

    Added a SyncML example.

    diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 3d598448d3..e88ef95636 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,17 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/26/2019 +ms.date: 09/24/2019 ms.reviewer: manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -
    @@ -2335,17 +2331,17 @@ ADMX Info: -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 351f5e5e34..347736e526 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -15,7 +15,7 @@ manager: dansimp -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
    @@ -224,7 +224,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index b775445fbd..960dbecada 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -65,7 +65,7 @@ manager: dansimp -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index d2d5b890fa..3596f45460 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -922,11 +922,11 @@ Value type is integer. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_Enum -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -989,11 +989,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1051,11 +1051,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: Windows *Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* @@ -1116,11 +1116,11 @@ Value type is chr. ADMX Info: -- GP English name: Let Windows apps access background spatial perception -- GP name: LetAppsAccessBackgroundSpatialPerception -- GP element: LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List -- GP path: Windows Components/App Privacy -- GP ADMX file name: AppPrivacy.admx +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 15a529a427..43f3e09bab 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -97,9 +97,6 @@ Supported values: - - -
    Footnotes: @@ -109,4 +106,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index bd12c8d9b7..5450d8dc1a 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -668,13 +668,7 @@ The following list shows the supported values: Enabling this policy prevents context menus from being invoked in the Start Menu. - -The following list shows the supported values: -- 0 (default) – False (Do not disable). -- 1 - True (disable). - - ADMX Info: - GP English name: *Disable context menus in the Start Menu* @@ -684,6 +678,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -1100,13 +1098,7 @@ Added in Windows 10, version 1709. Enabling this policy removes the people icon Value type is integer. - -The following list shows the supported values: -- 0 (default) – False (do not hide). -- 1 - True (hide). - - ADMX Info: - GP English name: *Remove the People Bar from the taskbar* @@ -1115,6 +1107,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
    diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index eade9cb700..233d029683 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -395,7 +395,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -532,9 +532,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. @@ -763,16 +763,14 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. -> -> The following list shows the supported values: -> orted values: + + +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. - @@ -1006,10 +1004,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 082308817e..6b1d56a0b6 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -113,10 +113,11 @@ By default, this policy is not configured and the SKU based defaults are used fo -ADMX Info:
    - GP English name: Troubleshooting: Allow users to access recommended troubleshooting for known problems -- GP name: TroubleshootingAllowRecommendations -- GP path: Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool -- GP ADMX file name: MSDT.admx +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* @@ -127,8 +128,6 @@ ADMX Info:
    - GP English name: Troubleshooting: Allow users to access r - -
    Footnotes: @@ -138,4 +137,5 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 86359678c2..c29f9811ad 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -13,6 +13,8 @@ manager: dansimp # Policy CSP - Update +> [!NOTE] +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
    @@ -204,11 +206,6 @@ manager: dansimp
    -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). - -
    - **Update/ActiveHoursEnd** @@ -1379,49 +1376,6 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update u
    - -**Update/ConfigureFeatureUpdateUninstallPeriod** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4cross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. - - - - -
    - **Update/DeferFeatureUpdatesPeriodInDays** diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index e1bdd172ec..54f29148ec 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,7 @@ sections: text: " - + From fbd9612a3c231c7e4a214e9a5b31bde412c04665 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Sep 2019 10:13:49 -0700 Subject: [PATCH 36/57] add other os --- .../threat-protection/microsoft-defender-atp/machine-tags.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md index c9543f40e7..08ab2a0d71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md @@ -61,6 +61,9 @@ You can also delete tags from this view. >- Windows Server, version 1803 or later >- Windows Server 2016 >- Windows Server 2012 R2 +>- Windows Server 2008 R2 SP1 +>- Windows 8.1 +>- Windows 7 SP1 Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines. From 32193dbdc073de271ac2526056d6454909dd2762 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 10:26:44 -0700 Subject: [PATCH 37/57] Added Windows version --- .../mdm/new-in-windows-mdm-enrollment-management.md | 3 +++ .../mdm/policy-configuration-service-provider.md | 6 ++++++ .../client-management/mdm/policy-csp-deviceinstallation.md | 4 ++-- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 1c11eca4c1..b635a732a2 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -103,6 +103,8 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • DeviceHealthMonitoring/AllowDeviceHealthMonitoring
  • DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope
  • DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination
    • +
  • DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs
    • +
  • DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs
  • Experience/ShowLockOnUserTile
  • InternetExplorer/AllowEnhancedSuggestionsInAddressBar
  • InternetExplorer/DisableActiveXVersionListAutoDownload
    • @@ -1905,6 +1907,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o |New or updated topic | Description| |--- | ---| |[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policices:
    DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| ### August 2019 diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 9a03db87e3..360d56c02f 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1027,6 +1027,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    +
    + DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
    DeviceInstallation/PreventDeviceMetadataFromNetwork
    @@ -1036,6 +1039,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
    +
    + DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
    DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
    diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index d83435f182..712ae6009c 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -307,7 +307,7 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i -This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. @@ -690,7 +690,7 @@ For example, this custom profile blocks installation and usage of USB devices wi -This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. From 2527c59e5a27de1fb12cc301009ef4e24061b8a3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Sep 2019 11:06:17 -0700 Subject: [PATCH 38/57] fix yaml --- .../microsoft-defender-atp/configure-endpoints-non-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 7da16a125c..d241c26107 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author macaparas +ms.author: macaparas author: mjcaparas ms.localizationpriority: medium manager: dansimp From c80ef354dc3fe258b142682afe48045e20673a22 Mon Sep 17 00:00:00 2001 From: Raaj Baskaran Date: Wed, 25 Sep 2019 16:01:51 -0500 Subject: [PATCH 39/57] fixed ms alias in metadata --- .../microsoft-defender-atp/configure-endpoints-non-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index d241c26107..4fd47f3d99 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: macaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp From ed26cff25f1fa9d982710e6aee4cd9628b604c03 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 14:08:15 -0700 Subject: [PATCH 40/57] Updated version --- ...ew-in-windows-mdm-enrollment-management.md | 6 +- .../client-management/mdm/policy-csp-audit.md | 590 +++++++++--------- 2 files changed, 300 insertions(+), 296 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 0e6b603e24..13350f5acf 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -137,7 +137,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • WindowsLogon/AllowAutomaticRestartSignOn
  • WindowsLogon/ConfigAutomaticRestartSignOn
  • WindowsLogon/EnableFirstLogonAnimation
    • - +     + + + diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 5d5b50ce4d..094538e285 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -218,10 +218,10 @@ ms.date: 09/24/2019 - - - - + + + + @@ -238,7 +238,7 @@ ms.date: 09/24/2019 -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -287,10 +287,10 @@ The following are the supported values: - - - - + + + + @@ -307,7 +307,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. @@ -353,10 +353,10 @@ The following are the supported values: - - - - + + + + @@ -373,7 +373,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. @@ -421,10 +421,10 @@ The following are the supported values: - - - - + + + + @@ -441,7 +441,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. @@ -488,10 +488,10 @@ The following are the supported values: - - - - + + + + @@ -508,7 +508,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. @@ -555,10 +555,10 @@ The following are the supported values: - - - - + + + + @@ -575,7 +575,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. If you do not configure this policy setting, no audit event is generated when a logon session is closed. @@ -622,10 +622,10 @@ The following are the supported values: - - - - + + + + @@ -642,7 +642,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. @@ -692,10 +692,10 @@ The following are the supported values: - - - - + + + + @@ -712,7 +712,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. If you do not configure this policy settings, IAS and NAP user access requests are not audited. @@ -759,10 +759,10 @@ Default: Success, Failure. - - - - + + + + @@ -779,7 +779,7 @@ Default: Success, Failure. -Available in Windows 10, version 1803 and later. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. @@ -831,10 +831,10 @@ The following are the supported values: - - - - + + + + @@ -851,9 +851,9 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by special logons, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. -- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [article 947223 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121697). +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-special-logon). Volume: Low. @@ -897,10 +897,10 @@ The following are the supported values: - - - - + + + + @@ -917,7 +917,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. @@ -965,10 +965,10 @@ The following are the supported values: - - - - + + + + @@ -985,7 +985,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by validation tests on user account logon credentials. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. @@ -1031,10 +1031,10 @@ The following are the supported values: - - - - + + + + @@ -1051,7 +1051,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. @@ -1098,10 +1098,10 @@ The following are the supported values: - - - - + + + + @@ -1118,7 +1118,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. @@ -1165,10 +1165,10 @@ The following are the supported values: - - - - + + + + @@ -1185,7 +1185,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. Currently, there are no events in this subcategory. @@ -1230,10 +1230,10 @@ The following are the supported values: - - - - + + + + @@ -1250,7 +1250,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to application groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. @@ -1299,10 +1299,10 @@ The following are the supported values: - - - - + + + + @@ -1319,7 +1319,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a computer account changes. @@ -1366,10 +1366,10 @@ The following are the supported values: - - - - + + + + @@ -1386,7 +1386,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. @@ -1439,10 +1439,10 @@ The following are the supported values: - - - - + + + + @@ -1459,7 +1459,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: @@ -1511,10 +1511,10 @@ The following are the supported values: - - - - + + + + @@ -1531,7 +1531,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to security groups, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. @@ -1581,10 +1581,10 @@ The following are the supported values: - - - - + + + + @@ -1601,7 +1601,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes to user accounts. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. @@ -1655,10 +1655,10 @@ The following are the supported values: - - - - + + + + @@ -1675,7 +1675,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. Volume: High. @@ -1720,10 +1720,10 @@ The following are the supported values: - - - - + + + + @@ -1740,7 +1740,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. Only AD DS objects with a matching system access control list (SACL) are logged. @@ -1788,10 +1788,10 @@ The following are the supported values: - - - - + + + + @@ -1808,7 +1808,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. When possible, events logged in this subcategory indicate the old and new values of the object’s properties. @@ -1862,10 +1862,10 @@ The following are the supported values: - - - - + + + + @@ -1882,7 +1882,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. If you do not configure this policy setting, no audit event is generated during AD DS replication. @@ -1932,10 +1932,10 @@ The following are the supported values: - - - - + + + + @@ -1952,7 +1952,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. @@ -1998,10 +1998,10 @@ The following are the supported values: - - - - + + + + @@ -2018,7 +2018,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit when plug and play detects an external device. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. @@ -2064,10 +2064,10 @@ The following are the supported values: - - - - + + + + @@ -2084,7 +2084,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process is created. @@ -2130,10 +2130,10 @@ The following are the supported values: - - - - + + + + @@ -2150,7 +2150,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a process ends. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a process ends. @@ -2196,10 +2196,10 @@ The following are the supported values: - - - - + + + + @@ -2216,7 +2216,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit inbound remote procedure call (RPC) connections. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. @@ -2262,10 +2262,10 @@ The following are the supported values: - - - - + + + + @@ -2282,7 +2282,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by adjusting the privileges of a token. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. Volume: High. @@ -2326,10 +2326,10 @@ The following are the supported values: - - - - + + + + @@ -2346,7 +2346,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. @@ -2394,10 +2394,10 @@ The following are the supported values: - - - - + + + + @@ -2414,7 +2414,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: 1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. @@ -2465,10 +2465,10 @@ The following are the supported values: - - - - + + + + @@ -2485,7 +2485,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. AD CS operations include the following: - AD CS startup/shutdown/backup/restore. @@ -2546,10 +2546,10 @@ The following are the supported values: - - - - + + + + @@ -2566,7 +2566,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2614,10 +2614,10 @@ The following are the supported values: - - - - + + + + @@ -2634,7 +2634,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access a shared folder. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. @@ -2682,10 +2682,10 @@ The following are the supported values: - - - - + + + + @@ -2702,7 +2702,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. @@ -2751,10 +2751,10 @@ The following are the supported values: - - - - + + + + @@ -2771,7 +2771,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. @@ -2828,10 +2828,10 @@ The following are the supported values: - - - - + + + + @@ -2848,7 +2848,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). Volume: High. @@ -2892,10 +2892,10 @@ The following are the supported values: - - - - + + + + @@ -2912,7 +2912,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a handle is manipulated. @@ -2961,10 +2961,10 @@ The following are the supported values: - - - - + + + + @@ -2981,7 +2981,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] @@ -3028,10 +3028,10 @@ The following are the supported values: - - - - + + + + @@ -3048,7 +3048,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. For scheduler jobs, the following are audited: - Job created. - Job deleted. @@ -3102,10 +3102,10 @@ The following are the supported values: - - - - + + + + @@ -3122,7 +3122,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. @@ -3171,10 +3171,10 @@ The following are the supported values: - - - - + + + + @@ -3191,7 +3191,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. @@ -3237,10 +3237,10 @@ The following are the supported values: - - - - + + + + @@ -3257,7 +3257,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. @@ -3313,10 +3313,10 @@ The following are the supported values: - - - - + + + + @@ -3333,7 +3333,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. @@ -3394,10 +3394,10 @@ The following are the supported values: - - - - + + + + @@ -3414,7 +3414,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. @@ -3466,10 +3466,10 @@ The following are the supported values: - - - - + + + + @@ -3486,7 +3486,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. @@ -3537,10 +3537,10 @@ The following are the supported values: - - - - + + + + @@ -3557,7 +3557,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. @@ -3611,10 +3611,10 @@ The following are the supported values: - - - - + + + + @@ -3631,7 +3631,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. @@ -3681,10 +3681,10 @@ The following are the supported values: - - - - + + + + @@ -3701,7 +3701,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. @@ -3756,10 +3756,10 @@ The following are the supported values: - - - - + + + + @@ -3776,7 +3776,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. @@ -3853,10 +3853,10 @@ The following are the supported values: - - - - + + + + @@ -3915,10 +3915,10 @@ The following are the supported values: - - - - + + + + @@ -3935,7 +3935,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. @@ -3996,10 +3996,10 @@ The following are the supported values: - - - - + + + + @@ -4016,7 +4016,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. @@ -4069,10 +4069,10 @@ The following are the supported values: - - - - + + + + @@ -4089,7 +4089,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit any of the following events: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. @@ -4137,10 +4137,10 @@ Default: Success, Failure. - - - - + + + + @@ -4157,7 +4157,7 @@ Default: Success, Failure. -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. @@ -4204,10 +4204,10 @@ The following are the supported values: - - - - + + + + @@ -4224,7 +4224,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events related to security system extensions or services, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. @@ -4273,10 +4273,10 @@ The following are the supported values: - - - - + + + + @@ -4293,7 +4293,7 @@ The following are the supported values: -Available in Windows 10, version 1803 and later. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. From acf34af800938bb474d84837e3393212440c25bc Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 15:26:45 -0700 Subject: [PATCH 41/57] Updated default values --- .../client-management/mdm/policy-csp-audit.md | 33 +++++++++---------- 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 094538e285..8ca25e3b46 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -661,9 +661,9 @@ GP Info: The following are the supported values: - 0 — Off/None -- 1 (default on Client editions) — Success +- 1 (default) — Success - 2 — Failure -- 3 (default on Server editions) — Success+Failure +- 3 — Success+Failure @@ -729,9 +729,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. @@ -999,8 +998,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1066,8 +1065,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1133,8 +1132,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1334,8 +1333,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -1756,8 +1755,8 @@ GP Info: The following are the supported values: -- 0 (default on Client editions) — Off/None -- 1 (default on Server editions) — Success +- 0 (default) — Off/None +- 1 — Success - 2 — Failure - 3 — Success+Failure @@ -4107,9 +4106,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. @@ -4313,9 +4311,8 @@ The following are the supported values: - 0 — Off/None - 1 — Success - 2 — Failure -- 3 — Success+Failure +- 3 (default) — Success+Failure -Default: Success, Failure. From 2492957c1987671760ecf66e9d7cde580f9f6ea9 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 15:29:21 -0700 Subject: [PATCH 42/57] Cleanup bash snippets --- ...rosoft-defender-atp-mac-install-manually.md | 18 +++++++++--------- ...oft-defender-atp-mac-install-with-intune.md | 11 ++++++----- ...osoft-defender-atp-mac-install-with-jamf.md | 13 +++++++------ .../microsoft-defender-atp-mac-resources.md | 6 +++--- .../microsoft-defender-atp-mac.md | 2 +- 5 files changed, 26 insertions(+), 24 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index e3142e03ef..ba4afb804d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -48,11 +48,11 @@ Download the installation and onboarding packages from Windows Defender Security Extract the contents of the .zip files: ```bash - ls -l + $ ls -l total 721152 -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py ``` @@ -92,7 +92,7 @@ If you did not enable Microsoft's driver during installation, then the applicati You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : false realTimeProtectionEnabled : true @@ -112,7 +112,7 @@ In this case, you need to perform the following steps to enable Real-Time Protec 1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - sudo kextutil /Library/Extensions/wdavkext.kext + $ sudo kextutil /Library/Extensions/wdavkext.kext Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Diagnostics for /Library/Extensions/wdavkext.kext: @@ -125,13 +125,13 @@ In this case, you need to perform the following steps to enable Real-Time Protec 4. In Terminal, install the driver again. This time the operation will succeed: ```bash -sudo kextutil /Library/Extensions/wdavkext.kext +$ sudo kextutil /Library/Extensions/wdavkext.kext ``` The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : true realTimeProtectionEnabled : true @@ -145,20 +145,20 @@ realTimeProtectionEnabled : true The client machine is not associated with orgId. Note that the *orgId* attribute is blank. ```bash - mdatp --health orgId + $ mdatp --health orgId ``` 2. Run the Python script to install the configuration file: ```bash - /usr/bin/python WindowsDefenderATPOnboarding.py + $ /usr/bin/python WindowsDefenderATPOnboarding.py Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) ``` 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: ```bash - mdatp --health orgId + $ mdatp --health orgId E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 21be43c179..1abf3471f5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -50,28 +50,29 @@ Download the installation and onboarding packages from Microsoft Defender Securi Extract the contents of the .zip files: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721688 -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` 7. Make IntuneAppUtil an executable: - ```mavel-macmini:Downloads test$ chmod +x IntuneAppUtil``` + ```bash + $ chmod +x IntuneAppUtil + ``` 8. Create the wdav.pkg.intunemac package from wdav.pkg: ```bash - mavel-macmini:Downloads test$ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" Microsoft Intune Application Utility for Mac OS X Version: 1.0.0.0 Copyright 2018 Microsoft Corporation diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 9a52b56369..621dee60a6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -51,17 +51,16 @@ Download the installation and onboarding packages from Windows Defender Security 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721160 -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` ## Create JAMF policies @@ -166,7 +165,7 @@ Once the policy is applied, you'll see the Microsoft Defender ATP icon in the ma You can monitor policy installation on a device by following the JAMF log file: ```bash - mavel-mojave:~ testuser$ tail -f /var/log/jamf.log + $ tail -f /var/log/jamf.log Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV @@ -179,7 +178,7 @@ You can monitor policy installation on a device by following the JAMF log file: You can also check the onboarding status: ```bash -mavel-mojave:~ testuser$ mdatp --health +$ mdatp --health ... licensed : true orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" @@ -195,7 +194,7 @@ orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash -mdatp --health healthy +$ mdatp --health healthy ``` The above command prints "1" if the product is onboarded and functioning as expected. @@ -219,6 +218,8 @@ Create a script in **Settings > Computer Management > Scripts**. This script removes Microsoft Defender ATP from the /Applications directory: ```bash + #!/bin/bash + echo "Is WDAV installed?" ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index e8697f63a3..933282df5d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -31,7 +31,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 1. Increase logging level: ```bash - mdatp --log-level verbose + $ mdatp --log-level verbose Creating connection to daemon Connection established Operation succeeded @@ -42,7 +42,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - mdatp --diagnostic --create + $ mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -50,7 +50,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 4. Restore logging level: ```bash - mdatp --log-level info + $ mdatp --log-level info Creating connection to daemon Connection established Operation succeeded diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index 7c18dc31d2..f87f5332c7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -69,7 +69,7 @@ To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/ap If you prefer the command line, you can also check the connection by running the following command in Terminal: ```bash -curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' ``` The output from this command should be similar to the following: From 06563947d6bc76a275acfd74051aa08c6abe56e4 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 16:10:33 -0700 Subject: [PATCH 43/57] Wording fixes --- .../microsoft-defender-atp-mac-preferences.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index 1902cc1a3f..80ec6a0f67 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -66,7 +66,7 @@ Whether real-time protection (scan files as they are accessed) is enabled or not Whether the antivirus engine runs in passive mode or not. In passive mode: - Real-time protection is turned off -- On demand scanning is turned on +- On-demand scanning is turned on - Automatic threat remediation is turned off - Security intelligence updates are turned on - Status menu icon is hidden @@ -253,7 +253,7 @@ The *userInterface* section of the configuration profile is used to manage the p #### Show / hide status menu icon -Whether the status menu icon (shown in the top right corner of the screen) is hidden or not. +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. ||| |:---|:---| From b76be9b4ec2e03033321acdf88c4ab31bbc0c228 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 16:32:16 -0700 Subject: [PATCH 44/57] Fixed typos --- windows/client-management/mdm/policy-csp-audit.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 8ca25e3b46..710784706c 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -307,9 +307,9 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. Volume: Low on a client computer. Medium on a domain controller or a network server. @@ -852,7 +852,7 @@ The following are the supported values: Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. -- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-special-logon). +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). Volume: Low. @@ -1400,7 +1400,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Distributio Group Management* +- GP English name: *Audit Distribution Group Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -2701,7 +2701,7 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. From b6c2428184714db5f9e3a248b818ba205dbd4194 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 16:38:31 -0700 Subject: [PATCH 45/57] minor updates --- windows/client-management/mdm/policy-csp-audit.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 710784706c..5d46a69134 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -510,8 +510,7 @@ The following are the supported values: Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. -If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If - you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. Volume: High. @@ -2980,7 +2979,7 @@ The following are the supported values: -Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events. > [!Note] From 9e49add0af14c99c39e2d06e36a6aff186f17c96 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 25 Sep 2019 16:50:30 -0700 Subject: [PATCH 46/57] Removed Korean IME --- .../policy-configuration-service-provider.md | 9 +++ .../mdm/policy-csp-textinput.md | 58 ------------------- 2 files changed, 9 insertions(+), 58 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 05ec05440b..f28c0d1e07 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -3368,6 +3368,15 @@ The following diagram shows the Policy configuration service provider in tree fo
    TextInput/AllowLinguisticDataCollection
    +
    + TextInput/ConfigureJapaneseIMEVersion +
    +
    + TextInput/ConfigureSimplifiedChineseIMEVersion +
    +
    + TextInput/ConfigureTraditionalChineseIMEVersion +
    TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 14e526875c..e996089576 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -62,9 +62,6 @@ manager: dansimp
    TextInput/ConfigureJapaneseIMEVersion
    -
    - TextInput/ConfigureKoreanIMEVersion -
    TextInput/ConfigureSimplifiedChineseIMEVersion
    @@ -772,61 +769,6 @@ The following list shows the supported values:
    - -**TextInput/ConfigureKoreanIMEVersion** - - -
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. Additionally, on September 24, 2019, mitigation for this vulnerability will be available via Windows Update (WU) and Windows Server Update Services (WSUS) as part of the 9C optional update for all supported versions of Windows, with the exception of Windows 10, version 1903. For devices running Windows 10, version 1903, mitigation for this vulnerability will be available via Windows Update and WSUS as part of the optional 9D update (targeted for September 26, 2019.) You can get the update in Windows via Settings > Windows Update > Check for Updates. (Note: Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.)

    For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
    		September 24, 2019
    11:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    Policy CSP - Audit

    Added new Audit policies in Windows 10, version 1903.

    +
    ApplicationControl CSP
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    cross markcheck markcheck markcheck markcheck markcheck mark6check mark6check mark6check mark6
    - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -> [!NOTE] -> - This policy is enforced only in Windows 10 for desktop. -> - This policy requires reboot to take effect. - -Added in next major release of Windows 10. Allows IT admins to configure Microsoft Korean IME version in the desktop. - - - -The following list shows the supported values: - -- 0 (default) - Allows you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is configured by default. -- 1 - Does not allow you to configure which Microsoft Korean IME version to use. The previous version of Microsoft Korean IME is always selected. -- 2 - Does not allow you to configure which Microsoft Korean IME version to use. The new Microsoft Korean IME version is always selected. - - - - -
    - **TextInput/ConfigureSimplifiedChineseIMEVersion** From 8d64a9f6af542029b4995ea6b11f5bee9060edc6 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 25 Sep 2019 17:07:40 -0700 Subject: [PATCH 47/57] Update command for diagnostic generation --- .../microsoft-defender-atp-mac-resources.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index 933282df5d..2f67653ec0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -39,10 +39,10 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem -3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - $ mdatp --diagnostic --create + $ sudo mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -82,13 +82,13 @@ Important tasks, such as controlling product settings and triggering on-demand s |-------------|-------------------------------------------|-----------------------------------------------------------------------| |Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | |Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | -|Configuration|Turn on/off product diagnostics |`mdatp --config diagnostic [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | |Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | |Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| |Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | |Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| |Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | |Health |Check the product's health |`mdatp --health` | |Protection |Scan a path |`mdatp --scan --path [path]` | |Protection |Do a quick scan |`mdatp --scan --quick` | From 142842f281f51c655eaa6c8b25d3bdf12cb65b8a Mon Sep 17 00:00:00 2001 From: Robert Mazzoli Date: Thu, 26 Sep 2019 07:08:52 -0700 Subject: [PATCH 48/57] Updates to loc metadata per Tina --- devices/surface-hub/index.md | 2 +- devices/surface/get-started.md | 2 +- devices/surface/index.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index 6d0b532210..110355baf4 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -9,7 +9,7 @@ ms.tgt_pltfrm: na ms.devlang: na ms.topic: landing-page description: "Get started with Microsoft Surface Hub." -localization_priority: High +ms.localizationpriority: High --- # Get started with Surface Hub diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md index 2ea4ff4188..7e007abc4e 100644 --- a/devices/surface/get-started.md +++ b/devices/surface/get-started.md @@ -10,7 +10,7 @@ ms.tgt_pltfrm: na ms.devlang: na ms.topic: landing-page description: "Get started with Microsoft Surface devices" -localization_priority: High +ms.localizationpriority: High --- # Get started with Surface devices diff --git a/devices/surface/index.md b/devices/surface/index.md index 8a40146adb..2677bffc49 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -8,7 +8,7 @@ ms.author: robmazz manager: laurawi ms.topic: hub-page keywords: Microsoft Surface, Microsoft Surface Hub, Surface documentation -localization_priority: High +ms.localizationpriority: High audience: ITPro ms.prod: Surface description: Learn about Microsoft Surface and Surface Hub devices. From 2ed1aa565641967f8f605152cba76b3d2d81d303 Mon Sep 17 00:00:00 2001 From: John Liu <49762389+ShenLanJohn@users.noreply.github.com> Date: Thu, 26 Sep 2019 09:21:31 -0700 Subject: [PATCH 49/57] CAT Auto Pulish for Windows Release Messages - CAT_AutoPublish_20190926083738 (#1207) --- .../resolved-issues-windows-10-1903.yml | 2 + .../status-windows-10-1903.yml | 4 +- ...ndows-7-and-windows-server-2008-r2-sp1.yml | 2 - .../windows-message-center.yml | 44 +------------------ 4 files changed, 5 insertions(+), 47 deletions(-) diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 5178fde6ad..9f94df5b29 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -68,6 +69,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    + diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a6705b085d..6d6d7771bc 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,10 +65,10 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    + - @@ -99,10 +99,10 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

    See details >    		N/A

    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

    See details >    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		September 10, 2019
    10:00 AM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4512941    		August 30, 2019
    10:00 AM PT
    + -
    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

    To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.

    Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		N/A

    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To mitigate the issue, open settings in the impacted game and disable multi-channel audio, if this option is available. You can also search in the Windows Control Panel for 3rd party audio device control panels and disable Multi-channel audio or Virtual Surround Sound, if these options are available.  

    Next steps: We are working on a resolution and estimates a solution will be available in late September.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4515384.

    Back to top    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		Resolved:
    September 10, 2019
    10:00 AM PT

    Opened:
    September 04, 2019
    02:25 PM PT
    diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index a3fe4bad82..88e7011cee 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -61,7 +61,6 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    -
    SummaryOriginating updateStatusLast updated
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    " @@ -87,7 +86,6 @@ sections: - type: markdown text: " -
    DetailsOriginating updateStatusHistory
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

    Back to top    		August 13, 2019
    KB4512506    		Resolved External
    		Last updated:
    August 27, 2019
    02:29 PM PT

    Opened:
    August 13, 2019
    10:05 AM PT
    IA64 and x64 devices may fail to start after installing updates
    IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
    \"File: \\Windows\\system32\\winload.efi
    Status: 0xc0000428
    Info: Windows cannot verify the digital signature for this file.\"

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

    Back to top    		August 13, 2019
    KB4512506    		Mitigated
    		Last updated:
    August 17, 2019
    12:59 PM PT

    Opened:
    August 13, 2019
    08:34 AM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index b7d54944e0..06dc6d0c37 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,6 +50,7 @@ sections: text: " + @@ -94,48 +95,5 @@ Given the potential impact to customers and their businesses, we have also relea For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MessageDate
    September 2019 Windows 10, version 1903 \"D\" optional release is available
    The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 26, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation and more information for this vulnerability is available from the Microsoft Security Update Guide at CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions of Windows, IT admins using WSUS can import this update into WSUS/SCCM manually from Microsoft Update Catalog. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    May 10, 2019
    10:00 AM PT
    Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
    A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.    		April 19, 2019
    10:00 AM PT
    The benefits of Windows 10 Dynamic Update
    Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed.

    - -
    Find out which components are updated by Dynamic Update, how Dynamic Update is initiated, and how to enable or disable it.
    		April 17, 2019
    11:26 AM PT
    Improvements to the Windows 10 update experience are coming
    Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.    		April 04, 2019
    09:00 AM PT
    Take action: review your Windows Update for Business deferral values
    If devices under your management are still running Windows 10 Pro or Windows 10 Pro for Workstations, version 1709, your devices will reach end of service on April 9, 2019 if you have configured both of the following Windows Update for Business policies:
    -
      -
    • Branch readiness is configured as Semi-Annual Channel (SAC)
      • -
    • Feature update deferral is configured as 274 days or more
      • -
    -In order avoid this, you need to set your feature update deferral policy to 273 days or less.
    		April 03, 2019
    05:47 PM PT
    Find a list of currently supported versions and previous releases
    Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.    		March 28, 2019
    02:00 PM PT
    Windows 10, version 1809 designated for broad deployment
    Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.    		March 28, 2019
    10:00 AM PT
    Reminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019
    The additional servicing for Windows 10 Enterprise, Education, and IoT Enterprise editions ends on April 9, 2019 and doesn't extend beyond this date. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Devices running Windows 10 Enterprise 2016 LTSB will continue to receive updates until October 2026 per the Fixed Lifecycle Policy. Windows 10, version 1607 devices running the Intel “Clovertrail” chipset will continue to receive updates until January 2023.
    		March 12, 2019
    10:00 AM PT
    Reminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019
    Windows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstations, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.
    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
    A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
    A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.    		March 12, 2019
    10:00 AM PT
    Reminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
    March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.    		March 12, 2019
    10:00 AM PT
    How do we measure and improve the quality of Windows?
    Measuring the quality of Windows is a complex undertaking that requires gathering a variety of diagnostic signals from millions of devices within the Windows ecosystem. In addition to rigorous internal testing, we rely heavily on the feedback provided through diagnostic data to detect and fix problems before we release new updates of Windows to the general population, and to monitor the impact of those updates after each release.

    - -
    Get insight into some of the practices we employ to measure and improve the quality of Windows.
    		March 06, 2019
    10:23 AM PT
    Getting to know the Windows update history pages
    Windows update history pages offer detailed information about each Windows update: the type of update, which operating systems it affects, the improvements and fixes included, and how to get the update. See how simple it is to use this important resource to access information for Windows 10, Windows Server 2019, and earlier versions of the Windows and Windows Server operating systems.
    		February 21, 2019
    06:37 PM PT
    Share your feedback: Windows update history
    We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.    		February 21, 2019
    12:00 PM PT
    Plan for change: Windows Update for Business and the retirement of SAC-T
    Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.    		February 14, 2019
    12:00 PM PT
    Champs corner: Classifying Windows updates in common deployment tools
    If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.    		February 05, 2019
    10:34 AM PT
    Update: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
    Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.    		February 05, 2019
    09:00 AM PT
    Global DNS outage affecting Windows Update customers
    Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.

    - -While this was not an issue with Microsoft’s services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers.

    - -If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you.
    		January 29, 2019
    04:15 PM PT
    Application compatibility in the Windows ecosystem
    Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.    		January 15, 2019
    10:00 AM PT
    Modern desktop servicing: the year in review
    2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.    		December 19, 2018
    02:20 PM PT
    Driver quality in the Windows ecosystem
    Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.    		December 19, 2018
    10:04 AM PT
    Introducing the Modern Desktop podcast series
    In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.    		December 18, 2018
    01:00 PM PT
    Measuring Delivery Optimization and its impact to your network
    If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.    		December 13, 2018
    03:48 PM PT
    Windows monthly security and quality updates overview
    Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.    		December 10, 2018
    10:00 AM PT
    LTSC: What is it, and when should it be used?
    With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.    		November 29, 2018
    07:02 PM PT
    Plan for change: Local Experience Packs: What are they and when should you use them?
    When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).    		November 14, 2018
    11:10 AM PT
    Windows 10 Quality approach for a complex ecosystem
    While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.    		November 13, 2018
    10:00 AM PT
    Windows 10, version 1809 rollout resumes; now available on VLSC
    Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).    		November 13, 2018
    10:00 AM PT
    Express updates for Windows Server 2016 re-enabled for November 2018 update
    Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.    		November 12, 2018
    03:00 PM PT
    Plan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS
    To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

    Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Please make note of the dates in the migration timeline and plan accordingly.
    		November 09, 2018
    10:00 AM PT
    " From 39e9b3711ba1c5af66ec63ddd83be5bcff7f897d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 26 Sep 2019 10:58:45 -0700 Subject: [PATCH 50/57] minor updates --- .../client-management/mdm/policy-csp-deviceinstallation.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 712ae6009c..b470f3a5cf 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -4,6 +4,7 @@ ms.reviewer: manager: dansimp description: Policy CSP - DeviceInstallation ms.author: dansimp +ms.date: 09/26/2019 ms.topic: article ms.prod: w10 ms.technology: windows @@ -139,7 +140,7 @@ To enable this policy, use the following SyncML. This example allows Windows to ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt >>> [Device Installation Restrictions Policy Check] @@ -254,7 +255,7 @@ Enclose the class GUID within curly brackets {}. To configure multiple classes, ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt From 24662139864342103320ff37697f27d0ad61e0c6 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 26 Sep 2019 11:26:23 -0700 Subject: [PATCH 51/57] Fixed a typo --- .../mdm/new-in-windows-mdm-enrollment-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 3c87d115e8..48023ee817 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1911,7 +1911,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o |New or updated topic | Description| |--- | ---| |[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| -|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policices:
    DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
    DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| ### August 2019 From 030a36f3eabf32a69333a5e876fc185794bebaa5 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 26 Sep 2019 11:27:21 -0700 Subject: [PATCH 52/57] Removed en-us --- .../client-management/mdm/policy-csp-deviceinstallation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index b470f3a5cf..ba62dc186a 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -314,7 +314,7 @@ If you enable this policy setting, Windows is allowed to install or update any d If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. -Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] @@ -697,7 +697,7 @@ If you enable this policy setting, Windows is prevented from installing a device If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. -Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] From ab3ebcb989c37f172e1f362e06fc82201dd4f80c Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 26 Sep 2019 12:11:06 -0700 Subject: [PATCH 53/57] updating metadata... again --- .../change-history-ms-edu-get-started.md | 4 ++-- ...configure-microsoft-store-for-education.md | 4 ++-- .../get-started/enable-microsoft-teams.md | 4 ++-- .../finish-setup-and-other-tasks.md | 4 ++-- .../get-started-with-microsoft-education.md | 4 ++-- .../inclusive-classroom-it-admin.md | 4 ++-- .../set-up-office365-edu-tenant.md | 4 ++-- .../set-up-windows-10-education-devices.md | 4 ++-- .../set-up-windows-education-devices.md | 4 ++-- .../get-started/use-intune-for-education.md | 4 ++-- education/get-started/use-school-data-sync.md | 4 ++-- education/index.md | 6 ++--- .../educator-tib-get-started.md | 4 ++-- education/trial-in-a-box/index.md | 6 ++--- .../trial-in-a-box/itadmin-tib-get-started.md | 4 ++-- education/trial-in-a-box/support-options.md | 6 ++--- education/windows/autopilot-reset.md | 4 ++-- education/windows/change-history-edu.md | 4 ++-- education/windows/change-to-pro-education.md | 4 ++-- .../windows/chromebook-migration-guide.md | 4 ++-- .../configure-windows-for-education.md | 4 ++-- .../deploy-windows-10-in-a-school-district.md | 4 ++-- .../windows/deploy-windows-10-in-a-school.md | 4 ++-- .../windows/edu-deployment-recommendations.md | 4 ++-- .../education-scenarios-store-for-business.md | 6 ++--- .../enable-s-mode-on-surface-go-devices.md | 4 ++-- .../windows/get-minecraft-device-promotion.md | 6 ++--- .../windows/get-minecraft-for-education.md | 6 ++--- education/windows/index.md | 4 ++-- education/windows/s-mode-switch-to-edu.md | 6 ++--- education/windows/school-get-minecraft.md | 6 ++--- .../set-up-school-pcs-azure-ad-join.md | 22 ++++++++--------- .../set-up-school-pcs-provisioning-package.md | 24 +++++++++---------- .../set-up-school-pcs-shared-pc-mode.md | 24 +++++++++---------- .../windows/set-up-school-pcs-technical.md | 4 ++-- .../windows/set-up-school-pcs-whats-new.md | 24 +++++++++---------- .../set-up-students-pcs-to-join-domain.md | 4 ++-- .../windows/set-up-students-pcs-with-apps.md | 4 ++-- education/windows/set-up-windows-10.md | 4 ++-- .../windows/take-a-test-app-technical.md | 4 ++-- education/windows/take-a-test-multiple-pcs.md | 4 ++-- education/windows/take-a-test-single-pc.md | 4 ++-- education/windows/take-tests-in-windows-10.md | 4 ++-- education/windows/teacher-get-minecraft.md | 6 ++--- education/windows/test-windows10s-for-edu.md | 4 ++-- .../windows/use-set-up-school-pcs-app.md | 4 ++-- ...indows-editions-for-education-customers.md | 4 ++-- 47 files changed, 142 insertions(+), 142 deletions(-) diff --git a/education/get-started/change-history-ms-edu-get-started.md b/education/get-started/change-history-ms-edu-get-started.md index 5273dbe9ce..8524f4cf8b 100644 --- a/education/get-started/change-history-ms-edu-get-started.md +++ b/education/get-started/change-history-ms-edu-get-started.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/07/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/configure-microsoft-store-for-education.md b/education/get-started/configure-microsoft-store-for-education.md index 3047fe8d8d..3aedd8379c 100644 --- a/education/get-started/configure-microsoft-store-for-education.md +++ b/education/get-started/configure-microsoft-store-for-education.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/29/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/enable-microsoft-teams.md b/education/get-started/enable-microsoft-teams.md index 986a6c4af0..76b967ae75 100644 --- a/education/get-started/enable-microsoft-teams.md +++ b/education/get-started/enable-microsoft-teams.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/28/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/finish-setup-and-other-tasks.md b/education/get-started/finish-setup-and-other-tasks.md index 8633a400ed..f0bd720e51 100644 --- a/education/get-started/finish-setup-and-other-tasks.md +++ b/education/get-started/finish-setup-and-other-tasks.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md index 64cf56759a..e5347813d5 100644 --- a/education/get-started/get-started-with-microsoft-education.md +++ b/education/get-started/get-started-with-microsoft-education.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: article ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index d8c3f7273d..0cd250e3ff 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 06/12/2018 ms.reviewer: manager: dansimp diff --git a/education/get-started/set-up-office365-edu-tenant.md b/education/get-started/set-up-office365-edu-tenant.md index f0887073f7..64499de75e 100644 --- a/education/get-started/set-up-office365-edu-tenant.md +++ b/education/get-started/set-up-office365-edu-tenant.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/set-up-windows-10-education-devices.md b/education/get-started/set-up-windows-10-education-devices.md index 7bd5123140..2bcc88089c 100644 --- a/education/get-started/set-up-windows-10-education-devices.md +++ b/education/get-started/set-up-windows-10-education-devices.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/set-up-windows-education-devices.md b/education/get-started/set-up-windows-education-devices.md index cb83590354..a3175b1d1b 100644 --- a/education/get-started/set-up-windows-education-devices.md +++ b/education/get-started/set-up-windows-education-devices.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/28/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/use-intune-for-education.md b/education/get-started/use-intune-for-education.md index 1e6eac8cf8..e3e3be043a 100644 --- a/education/get-started/use-intune-for-education.md +++ b/education/get-started/use-intune-for-education.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/29/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/use-school-data-sync.md b/education/get-started/use-school-data-sync.md index 14a34bcda5..6ab9b54cba 100644 --- a/education/get-started/use-school-data-sync.md +++ b/education/get-started/use-school-data-sync.md @@ -8,8 +8,8 @@ ms.sitesec: library ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/10/2017 ms.reviewer: manager: dansimp diff --git a/education/index.md b/education/index.md index 2bd9d1a152..c36a33ee36 100644 --- a/education/index.md +++ b/education/index.md @@ -1,11 +1,11 @@ ---- +--- layout: HubPage hide_bc: true title: Microsoft 365 Education documentation and resources | Microsoft Docs description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. -author: CelesteDG +author: dansimp ms.topic: hub-page -ms.author: celested +ms.author: dansimp ms.collection: ITAdminEDU ms.date: 10/30/2017 ms.prod: w10 diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index 7c079f414b..aff8c085b5 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index c91f1c0264..f21a0ddcf4 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box -description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. +description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, IT admin, educator, student, explore, Trial in a Box ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 12/11/2017 --- diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index 04b239b53b..1965c6abf7 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -9,8 +9,8 @@ ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index b377719a91..9cb32351de 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box Support -description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. +description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. keywords: support, troubleshooting, education, Microsoft 365 Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 2c11c122c4..ecc1f3f77c 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 06/27/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index b3dd38357b..9302c8fdb4 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index af1534d6a3..e40ce61ea7 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 9769d7a3bf..051954b11f 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -10,8 +10,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu, devices ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 1cb747217a..688b66c92b 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -7,8 +7,8 @@ ms.sitesec: library ms.prod: w10 ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/31/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 027127211f..43b68e46ad 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index ed3de28f37..3cfeafb6d3 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index cb30050aa8..1f3bcffff3 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -5,8 +5,8 @@ keywords: Windows 10 deployment, recommendations, privacy settings, school ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 5598256e19..3149237ba1 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -searchScope: +searchScope: - Store -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/30/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md index 0862548ea6..0b7fc8c617 100644 --- a/education/windows/enable-s-mode-on-surface-go-devices.md +++ b/education/windows/enable-s-mode-on-surface-go-devices.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/30/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md index 4864b6d4a0..bafc4ed6ae 100644 --- a/education/windows/get-minecraft-device-promotion.md +++ b/education/windows/get-minecraft-device-promotion.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 06/05/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 0908c78b04..7037b5ce14 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/29/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/index.md b/education/windows/index.md index 80684834ef..b40b009575 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md index 845f97f0c9..4860249e19 100644 --- a/education/windows/s-mode-switch-to-edu.md +++ b/education/windows/s-mode-switch-to-edu.md @@ -1,6 +1,6 @@ --- title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. +description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. keywords: Windows 10 S switch, S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU ms.mktglfcycl: deploy ms.localizationpriority: medium @@ -10,8 +10,8 @@ ms.pagetype: edu ms.date: 12/03/2018 ms.reviewer: manager: dansimp -ms.author: macapara -author: mjcaparas +ms.author: dansimp +author: dansimp --- # Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 00a5baee8a..515bfff44f 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/30/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 7b8f55bb14..6d62b6bb55 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -1,14 +1,14 @@ ---- -title: Azure AD Join with Set up School PCs app -description: Describes how Azure AD Join is configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: levinec -ms.author: ellevin +--- +title: Azure AD Join with Set up School PCs app +description: Describes how Azure AD Join is configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp ms.date: 01/11/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md index 48a2aa9549..12bbf4fc89 100644 --- a/education/windows/set-up-school-pcs-provisioning-package.md +++ b/education/windows/set-up-school-pcs-provisioning-package.md @@ -1,15 +1,15 @@ ---- -title: What's in Set up School PCs provisioning package -description: Lists the provisioning package settings that are configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 10/17/2018 +--- +title: What's in Set up School PCs provisioning package +description: Lists the provisioning package settings that are configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 10/17/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-shared-pc-mode.md b/education/windows/set-up-school-pcs-shared-pc-mode.md index 50b01da4f3..2ac3eb11d0 100644 --- a/education/windows/set-up-school-pcs-shared-pc-mode.md +++ b/education/windows/set-up-school-pcs-shared-pc-mode.md @@ -1,15 +1,15 @@ ---- -title: Shared PC mode for school devices -description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 07/13/2018 +--- +title: Shared PC mode for school devices +description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 07/13/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index ab45a9f0a7..67c378fb9f 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/11/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 546e8c7831..fa888ab81c 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -1,15 +1,15 @@ ---- -title: What's new in the Windows Set up School PCs app -description: Find out about app updates and new features in Set up School PCs. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 08/15/2019 +--- +title: What's new in the Windows Set up School PCs app +description: Find out about app updates and new features in Set up School PCs. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 08/15/2019 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 3842e9d435..0ebe308f14 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 8f09eb0561..c711403393 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -7,8 +7,8 @@ ms.pagetype: edu ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index 1f8eb4eb0f..b401df97ef 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 7106de6cfd..9f006e7a88 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/28/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index ac67906e9b..c49e6ea21f 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index bb20a3760e..41fbb7b7fd 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index cad3303266..4ff027e388 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/16/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 838aa85226..501e3f3249 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -searchScope: +author: dansimp +searchScope: - Store -ms.author: macapara +ms.author: dansimp ms.date: 01/05/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index 1ec8ad81a4..2b64a32bd1 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -7,8 +7,8 @@ ms.prod: w10 ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/30/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 1af547f463..3f31119391 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/23/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 52a4aa6bb6..80555a4b90 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp From 1b27c56f231f5ccda039681e050ba3750faeb3c7 Mon Sep 17 00:00:00 2001 From: Sarah Cooley Date: Thu, 26 Sep 2019 12:40:43 -0700 Subject: [PATCH 54/57] Minor formatting changes made minor formatting changes to the HoloLens docs. --- devices/hololens/hololens2-setup.md | 34 ++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md index d8ff62b687..e8350f4e65 100644 --- a/devices/hololens/hololens2-setup.md +++ b/devices/hololens/hololens2-setup.md @@ -22,10 +22,10 @@ The procedures below will help you set up a HoloLens 2 for the first time. Connect the power supply to the charging port by using the USB-C cable (included). Plug the power supply into a power outlet. - - When the device is charging, the battery indicator lights up in a wave pattern. - - When your HoloLens is on, the battery indicator displays the battery level in increments. - - When only one of the five lights is on, the battery level is below 20 percent. - - If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out. + - When the device is charging, the battery indicator lights up in a wave pattern. + - When your HoloLens is on, the battery indicator displays the battery level in increments. + - When only one of the five lights is on, the battery level is below 20 percent. + - If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out. > [!TIP] > To get an estimate of your current battery level, say "Hey Cortana, how much battery do I have left?" @@ -54,14 +54,14 @@ To turn on your HoloLens 2, press the Power button. The LED lights below the Po ### Power button actions for different power transitions -|To do this |Perform this action and watch for these indicator lights | +| To do this | Perform this action and watch for these indicator lights | | - | - | -|To turn on |**Single click** ![Press power button - no lights lit](images/hololens-2-button-turn-on.png) | -|To sleep |**Single click** ![Press power button - three lights lit](images/hololens-2-button-sleep.png) | -|To wake from sleep |**Single click** ![Press power button - no lights lit](images/hololens-2-button-wake.png) | -|To turn off |**Press and for hold 5s** ![Press and hold power button - all lights lit](images/hololens-2-button-turn-off.png) | -|To force the Hololens to restart if it is unresponsive |**Press and hold for 10s** ![Press and hold power button - all lights lit](images/hololens-2-button-turn-off.png) | -
    +| To turn on | Single button press - lights will indicate battery state. | +| To sleep | Single button press - lights will indicate battery state then go dark on sleep. | +| To wake from sleep | Single button press - lights will indicate battery state. | +| To turn off | Press and for hold 5s - all five lights will light then go dark on shutdown. | +| To force the Hololens to restart if it is unresponsive | Press and hold for 10s - all lights will light then go dark on shutdown. They'll relight on restart. | + ## HoloLens indicator lights Not sure what the indicator lights on your HoloLens mean? Here's some help! @@ -70,12 +70,12 @@ Not sure what the indicator lights on your HoloLens mean? Here's some help! |When you do this | And then the lights do this | It means | | - | - | - | -|You press the Power button. |All five lights turn on, then change to indicate the battery level. After four seconds, a sound plays. | HoloLens is starting up. | -|You press the Power button. |All five lights turn on, then change to indicate the battery level. A sound immediately plays. | HoloLens is on, awake, and ready to use. | -|You press and hold the Power button for five seconds or longer. |All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |HoloLens is shutting down. | -|You press and hold the Power button for less than five seconds. |All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |HoloLens is entering sleep. | -|You press the Power button. |One light flashes five times, then turns off. |The HoloLens battery is critically low. Charge your HoloLens. | -|You press the Power button. |All five lights flash five times, then turn off. |HoloLens cannot start correctly and is in an error state. | +| You press the Power button. |All five lights turn on, then change to indicate the battery level. After four seconds, a sound plays. | HoloLens is starting up. | +| You press the Power button. |All five lights turn on, then change to indicate the battery level. A sound immediately plays. | HoloLens is on, awake, and ready to use. | +| You press and hold the Power button for five seconds or longer. |All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |HoloLens is shutting down. | +| You press and hold the Power button for less than five seconds. |All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |HoloLens is entering sleep. | +| You press the Power button. |One light flashes five times, then turns off. |The HoloLens battery is critically low. Charge your HoloLens. | +| You press the Power button. |All five lights flash five times, then turn off. | HoloLens cannot start correctly and is in an error state. | ### Lights that indicate the battery level From 78d0c4db38177ce00654c06383961d9cda8678b9 Mon Sep 17 00:00:00 2001 From: Rebecca Agiewich Date: Thu, 26 Sep 2019 14:06:05 -0700 Subject: [PATCH 55/57] grammar fix --- windows/client-management/mdm/policy-csp-textinput.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index e996089576..060fa7985d 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -14,7 +14,7 @@ manager: dansimp # Policy CSP - TextInput > [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. +> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
    @@ -1514,4 +1514,4 @@ Footnotes: - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. - \ No newline at end of file + From 6c1c1835803a39b18de47c9058ceb73232b34c8e Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Thu, 26 Sep 2019 14:22:56 -0700 Subject: [PATCH 56/57] Fixed a spelling error Line 9: corrected "ms.ms.localizationpriority" to "ms.localizationpriority" --- devices/surface/surface-wireless-connect.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md index c8b1b592de..42d9e3a2c5 100644 --- a/devices/surface/surface-wireless-connect.md +++ b/devices/surface/surface-wireless-connect.md @@ -6,7 +6,7 @@ ms.mktglfcycl: manage ms.sitesec: library author: dansimp ms.audience: itpro -ms.ms.localizationpriority: normal +ms.localizationpriority: normal ms.author: dansimp ms.topic: article ms.date: 08/15/2019 From 3bc7c1b5545275194f055b83c21e3dafc3628cc4 Mon Sep 17 00:00:00 2001 From: Raaj Baskaran Date: Thu, 26 Sep 2019 16:39:41 -0500 Subject: [PATCH 57/57] fixed typo --- .../level-1-enterprise-basic-security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md index bd4027cdd4..87a52c4dd8 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md @@ -177,7 +177,7 @@ Microsoft recommends using [the rings methodology](https://docs.microsoft.com/wi | Network / Network Connections | Prohibit use of Internet Connection Sharing on your DNS domain network | Enabled | Determines whether administrators can enable and configure the Internet Connection Sharing (ICS) feature of an Internet connection and if the ICS service can run on the computer. | | Network / Network Provider | Hardened UNC Paths | \\\\\*\\SYSVOL and \\\\\*\\NETLOGON RequireMutualAuthentication = 1, RequireIntegrity = 1 | This policy setting configures secure access to UNC paths. If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. | | Network / Windows Connection Manager | Prohibit connection to non-domain networks when connected to domain authenticated network | Enabled | This policy setting prevents computers from connecting to both a domain-based network and a non-domain-based network at the same time. | -| System / Credentials Delegation | Encryption Oracle Remediation | Force Updated Clients | Enryption Oracle Remediation | +| System / Credentials Delegation | Encryption Oracle Remediation | Force Updated Clients | Encryption Oracle Remediation | | System / Credentials Delegation | Remote host allows delegation of non-exportable credentials | Enabled | When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode. | | System / Device Installation / Device Installation Restrictions | Prevent installation of devices that match any of these device IDs | [[[main setting]]] = Enabled
    Also apply to matching devices that are already installed = True
    1 = PCI\CC_0C0A | This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. if you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in a list that you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. | | System / Device Installation / Device Installation Restrictions | Prevent installation of devices using drivers that match these device setup classes | [[[main setting]]] = Enabled
    Also apply to matching devices that are already installed = True
    1 = {d48179be-ec20-11d1-b6b8-00c04fa372a7} | This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. if you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. |