diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 1b6792578c..31c46ffe7e 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7484,6 +7484,481 @@ "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker#device-encryption", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721530(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725978(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770729(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731463(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771822(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753825(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725818(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732933(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753367(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770426(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732202(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771233(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731164(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770565(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754085(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731123(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731908(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731788(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731447(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721532(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730835(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771044(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771733(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732752(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725693(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771664(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732615(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754986(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771716(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947826(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730841(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732486(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721528(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770289(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947845(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947794(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947848(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947800(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947783(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947799(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947827(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947819(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717261(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717238(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717284(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717277(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732023(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717256(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc772556(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770865(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753064(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725659(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731951(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717241(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717262(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717263(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717260(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717237(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717293(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717253(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717249(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717270(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717275(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717278(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717245(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717246(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717247(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717274(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717243(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717283(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717281(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717259(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717292(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717264(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717265(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717290(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717269(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717266(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717254(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717267(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717251(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717273(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770899(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771366(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc726039(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753540(v=ws.10)", + "redirect_document_id": false } ] -} \ No newline at end of file +} diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml index e95c203c60..addd4468b1 100644 --- a/browsers/edge/microsoft-edge.yml +++ b/browsers/edge/microsoft-edge.yml @@ -40,14 +40,6 @@ landingContent: - text: Evaluate the impact url: ./microsoft-edge-forrester.md - # Card (optional) - - title: Test your site on Microsoft Edge - linkLists: - - linkListType: overview - links: - - text: Test your site on Microsoft Edge for free on BrowserStack - url: https://developer.microsoft.com/microsoft-edge/tools/remote/ - # Card (optional) - title: Improve compatibility with Enterprise Mode linkLists: diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md index bae8eba426..dc91fc136e 100644 --- a/education/includes/education-content-updates.md +++ b/education/includes/education-content-updates.md @@ -2,20 +2,13 @@ -## Week of September 11, 2023 +## Week of November 06, 2023 | Published On |Topic title | Change | |------|------------|--------| -| 9/11/2023 | [Configure education themes for Windows 11](/education/windows/edu-themes) | modified | -| 9/11/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | - - -## Week of September 04, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 9/5/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | -| 9/5/2023 | [Windows for Education documentation](/education/windows/index) | modified | -| 9/5/2023 | [Windows 11 SE Overview](/education/windows/windows-11-se-overview) | modified | +| 11/7/2023 | [Reset devices with Autopilot Reset](/education/windows/autopilot-reset) | modified | +| 11/9/2023 | [Configure Stickers for Windows 11 SE](/education/windows/edu-stickers) | modified | +| 11/9/2023 | What's new in the Windows Set up School PCs app | removed | +| 11/9/2023 | [Management functionalities for Surface devices](/education/windows/tutorial-school-deployment/manage-surface-devices) | modified | +| 11/9/2023 | [Use Set up School PCs app](/education/windows/use-set-up-school-pcs-app) | modified | diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 7b14deeb86..bb0223c8fc 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -5,10 +5,6 @@ ms.date: 08/10/2022 ms.topic: how-to appliesto: - ✅ Windows 10 -ms.collection: - - highpri - - tier2 - - education --- # Reset devices with Autopilot Reset @@ -60,7 +56,7 @@ You can set the policy using one of these methods: ## Trigger Autopilot Reset Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. -] + To trigger Autopilot Reset: 1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. diff --git a/education/windows/index.yml b/education/windows/index.yml index 0c159bd537..3c3dfae79b 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -10,7 +10,6 @@ metadata: ms.technology: itpro-edu ms.collection: - education - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index 2fd353ae04..e82eb8a227 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -6,7 +6,6 @@ ms.date: 11/02/2023 appliesto: - ✅ Windows 11 SE ms.collection: - - highpri - education - tier1 --- diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index d30e2cc685..1b1055fb52 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure devices using group policy, [create a group policy object (GPO)](/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object) and use the following settings: \ No newline at end of file +To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) or [edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730903(v=ws.10)) a group policy object (GPO) and use the following settings: diff --git a/includes/configure/gpo-settings-2.md b/includes/configure/gpo-settings-2.md index bf8ee52309..88fd46ec27 100644 --- a/includes/configure/gpo-settings-2.md +++ b/includes/configure/gpo-settings-2.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -The policy settings can be configured locally by using the Local Group Policy Editor (`gpedit.msc`), linked to the domain or organizational units, and filtered to security groups. \ No newline at end of file +Group policies can be [linked](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732979(v=ws.10)) to domains or organizational units, [filtered using security groups](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc752992(v=ws.10)), or [filtered using WMI filters](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)). diff --git a/includes/configure/registry.md b/includes/configure/registry.md new file mode 100644 index 0000000000..9f01c1e254 --- /dev/null +++ b/includes/configure/registry.md @@ -0,0 +1,9 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 08/15/2023 +ms.topic: include +ms.prod: windows-client +--- + +To configure devices using the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index b08cd77d57..46ff46e15f 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -14,7 +14,6 @@ metadata: ms.prod: windows-client ms.collection: - tier1 - - highpri # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | tutorial | overview | quickstart | reference | sample | tutorial | video | whats-new diff --git a/windows/client-management/images/bing-chat-enterprise-chat-provider.png b/windows/client-management/images/bing-chat-enterprise-chat-provider.png new file mode 100644 index 0000000000..6213a99d16 Binary files /dev/null and b/windows/client-management/images/bing-chat-enterprise-chat-provider.png differ diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index aeaad6dc3b..9851b09748 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -1,31 +1,200 @@ --- title: Manage Copilot in Windows -description: Learn how to manage Copilot in Windows using MDM and group policy. +description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article -ms.date: 10/16/2023 +ms.technology: itpro-windows-copilot +ms.date: 11/06/2023 +ms.author: mstewart +author: mestew appliesto: -- ✅ Windows 11 +- ✅ Windows 11, version 22H2 or later --- # Manage Copilot in Windows + +>**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Windows is the first PC platform to provide centralized AI assistance for customers. Together, with Bing Chat, Copilot in Windows helps you bring your ideas to life, complete complex projects and collaborate instead of spending energy finding, launching and working across multiple applications. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it is possible for users to copy and paste sensitive information into the chat provider. -This article lists settings available to manage Copilot in Windows. To learn more about Copilot in Windows, see [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). +> [!Note] +> - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. +> - Copilot in Windows is being released in preview to select global markets as part of our latest update to Windows 11. The initial markets for the Copilot in Windows preview include North America and parts of Asia and South America. It is our intention to add additional markets over time. -## Turn off Copilot in Windows +## Configure Copilot in Windows for commercial environments -This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot when it's available to them. +At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: -| | Setting | -|------------------|---------------------------------------------------------------------------------------------------------| -| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | +1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) +1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows +1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled +1. Verify [other settings that might affect Copilot in Windows](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider + +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot in Windows and the icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot in Windows when it's available to them. + +|   | Setting | +|---|---| +| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | | **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | +## Chat provider platforms for Copilot in Windows -## Related articles +Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. -- [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0) +**Bing Chat**: -- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/copilot-in-windows-your-data-and-privacy-3e265e82-fc76-4d0a-afc0-4a0de528b73a) +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and if a user isn't signed in with their Microsoft account, the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: + - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) + - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. + + +**Bing Chat Enterprise**: + +[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: + +- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Bing Chat Enterprise is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). +- Bing Chat Enterprise is available, at no additional cost, for the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Microsoft 365 Business Standard + - Microsoft 365 Business Premium + + > [!Note] + > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which can be used in the Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. + +## Configure the chat provider platform that Copilot in Windows uses + +Configuring the correct chat provider platform for Copilot in Windows is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. + +### Bing Chat as the chat provider platform + +Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: + +- Bing Chat Enterprise isn't configured for the user +- The user isn't assigned a license that includes Bing Chat Enterprise +- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) +- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise + +### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) + +To verify that Bing Chat Enterprise is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: + +1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). + - Microsoft 365 Business Standard + - Microsoft 365 Business Premium +1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. +1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. +1. Verify that **Bing Chat Enterprise** is enabled for the user. +1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. + + > [!Note] + > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. + +The following sample PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: + +```powershell +# Install Microsoft Graph module +if (-not (Get-Module Microsoft.Graph.Users)) { + Install-Module Microsoft.Graph.Users +} + +# Connect to Microsoft Graph +Connect-MgGraph -Scopes 'User.Read.All' + +# Get all users +$users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, Mail, UserPrincipalName, AssignedPlans + +# Users with Bing Chat Enterprise enabled +$users | Where-Object { $_.AssignedPlans -and $_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -eq "Enabled" } | Format-Table + +# Users without Bing Chat Enterprise enabled +$users | Where-Object { -not $_.AssignedPlans -or ($_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -ne "Enabled") } | Format-Table +``` + +When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: + +:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: + +## Ensure the Copilot in Windows user experience is enabled + +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. + +### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients + +Copilot in Windows isn't technically enabled by default for managed Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager, Microsoft Intune, and Windows Autopatch are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to enable features under temporary enterprise control for these devices. Since enabling features behind [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: + +1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** + + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. + > [!Important] + > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager, Microsoft Intune, and Windows Autopatch are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + +1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. + + The optional updates policy applies to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: + - Automatically receive optional updates (including CFRs) + - This selection places devices into an early CFR phase + - Users can select which optional updates to receive + +1. Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. + +### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients + +Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. + +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: +- [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) +- [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) + +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using the following policy: + +- **CSP**: ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) +- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** + +## Other settings that might affect Copilot in Windows and its underlying chat provider + +Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: + +### Bing settings + +- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: + - mapping `www.bing.com` to `strict.bing.com` + - mapping `edgeservices.bing.com` to `strict.bing.com` + - blocking `bing.com` + +- If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + + |Key |Value | + |:---------|:------------| + |com.microsoft.intune.mam.managedbrowser.Chat| **true** (default) shows the interface
**false** hides the interface | + +### Microsoft Edge policies + +- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Copilot in Edge from being displayed. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. + +### Search settings + +- Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. +- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows and the Copilot in Edge user experiences. + +### Account settings + +- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Copilot in Edge. +- The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. + +## Microsoft's commitment to responsible AI + +Microsoft has been on a responsible AI journey since 2017, when we defined our principles and approach to ensuring this technology is used in a way that is driven by ethical principles that put people first. For more about our responsible AI journey, the ethical principles that guide us, and the tooling and capabilities we've created to assure that we develop AI technology responsibly, see [Responsible AI](https://www.microsoft.com/ai/responsible-ai). diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index 2e6a1b1f54..7944d29d03 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -10,7 +10,6 @@ metadata: ms.technology: itpro-manage ms.prod: windows-client ms.collection: - - highpri - tier1 author: vinaypamnani-msft ms.author: vinpa diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 9a3988642d..e825289b3c 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -8,7 +8,7 @@ ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 02/23/2018 +ms.date: 11/16/2023 --- # Update CSP @@ -40,7 +40,7 @@ The following example shows the Update configuration service provider in tree fo ----FailedUpdates --------Failed Update Guid ------------HResult -------------Status +------------State ------------RevisionNumber ----InstalledUpdates --------Installed Update Guid @@ -63,136 +63,152 @@ The following example shows the Update configuration service provider in tree fo ``` **./Vendor/MSFT/Update** -

The root node. +The root node. -

Supported operation is Get. +Supported operation is Get. **ApprovedUpdates** -

Node for update approvals and EULA acceptance on behalf of the end-user. +Node for update approvals and EULA acceptance on behalf of the end-user. > [!NOTE] > When the RequireUpdateApproval policy is set, the MDM uses the ApprovedUpdates list to pass the approved GUIDs. These GUIDs should be a subset of the InstallableUpdates list. -

The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update. +The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update. -

The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (that is, updates to the virus and spyware definitions on devices) and Security Updates (that is, product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstallation of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs due to changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. +The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (that is, updates to the virus and spyware definitions on devices) and Security Updates (that is, product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstallation of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs due to changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. > [!NOTE] > For the Windows 10 build, the client may need to reboot after additional updates are added. -

Supported operations are Get and Add. +Supported operations are Get and Add. **ApprovedUpdates/_Approved Update Guid_** -

Specifies the update GUID. +Specifies the update GUID. -

To auto-approve a class of updates, you can specify the Update Classifications GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. These GUIDs are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. +To auto-approve a class of updates, you can specify the Update Classifications GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. These GUIDs are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. -

Supported operations are Get and Add. +Supported operations are Get and Add. -

Sample syncml: +Sample syncml: ``` ./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d ``` **ApprovedUpdates/*Approved Update Guid*/ApprovedTime** -

Specifies the time the update gets approved. +Specifies the time the update gets approved. -

Supported operations are Get and Add. +Supported operations are Get and Add. **FailedUpdates** -

Specifies the approved updates that failed to install on a device. +Specifies the approved updates that failed to install on a device. -

Supported operation is Get. +Supported operation is Get. **FailedUpdates/_Failed Update Guid_** -

Update identifier field of the UpdateIdentity GUID that represents an update that failed to download or install. +Update identifier field of the UpdateIdentity GUID that represents an update that failed to download or install. -

Supported operation is Get. +Supported operation is Get. **FailedUpdates/*Failed Update Guid*/HResult** -

The update failure error code. +The update failure error code. -

Supported operation is Get. +Supported operation is Get. -**FailedUpdates/*Failed Update Guid*/Status** -

Specifies the failed update status (for example, download, install). +**FailedUpdates/*Failed Update Guid*/State** +Specifies the failed update state. -

Supported operation is Get. +| Update Status | Integer Value | +| -------------------------- | ------------- | +| UpdateStatusNewUpdate | 1 | +| UpdateStatusReadyToDownload| 2 | +| UpdateStatusDownloading | 4 | +| UpdateStatusDownloadBlocked| 8 | +| UpdateStatusDownloadFailed | 16 | +| UpdateStatusReadyToInstall | 32 | +| UpdateStatusInstalling | 64 | +| UpdateStatusInstallBlocked | 128 | +| UpdateStatusInstallFailed | 256 | +| UpdateStatusRebootRequired | 512 | +| UpdateStatusUpdateCompleted| 1024 | +| UpdateStatusCommitFailed | 2048 | +| UpdateStatusPostReboot | 4096 | + +Supported operation is Get. **FailedUpdates/*Failed Update Guid*/RevisionNumber** -

Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

Supported operation is Get. +Supported operation is Get. **InstalledUpdates** -

The updates that are installed on the device. +The updates that are installed on the device. -

Supported operation is Get. +Supported operation is Get. **InstalledUpdates/_Installed Update Guid_** -

UpdateIDs that represent the updates installed on a device. +UpdateIDs that represent the updates installed on a device. -

Supported operation is Get. +Supported operation is Get. **InstalledUpdates/*Installed Update Guid*/RevisionNumber** -

Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

Supported operation is Get. +Supported operation is Get. **InstallableUpdates** -

The updates that are applicable and not yet installed on the device. These updates include updates that aren't yet approved. +The updates that are applicable and not yet installed on the device. These updates include updates that aren't yet approved. -

Supported operation is Get. +Supported operation is Get. **InstallableUpdates/_Installable Update Guid_** -

Update identifiers that represent the updates applicable and not installed on a device. +Update identifiers that represent the updates applicable and not installed on a device. -

Supported operation is Get. +Supported operation is Get. **InstallableUpdates/*Installable Update Guid*/Type** -

The UpdateClassification value of the update. Valid values are: +The UpdateClassification value of the update. Valid values are: - 0 - None - 1 - Security - 2 - Critical -

Supported operation is Get. +Supported operation is Get. **InstallableUpdates/*Installable Update Guid*/RevisionNumber** -

The revision number for the update that must be passed in server to server sync to get the metadata for the update. +The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates** -

The updates that require a reboot to complete the update session. +The updates that require a reboot to complete the update session. -

Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/_Pending Reboot Update Guid_** -

Update identifiers for the pending reboot state. +Update identifiers for the pending reboot state. -

Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/InstalledTime** -

The time the update is installed. +The time the update is installed. -

Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/RevisionNumber** -

Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

Supported operation is Get. +Supported operation is Get. **LastSuccessfulScanTime** -

The last successful scan time. +The last successful scan time. -

Supported operation is Get. +Supported operation is Get. **DeferUpgrade** -

Upgrades deferred until the next period. +Upgrades deferred until the next period. -

Supported operation is Get. +Supported operation is Get. **Rollback** Added in Windows 10, version 1803. Node for the rollback operations. diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index e80c753918..65937f4400 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -1,18 +1,10 @@ --- title: Configure Windows 10 taskbar description: Administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: how-to -ms.localizationpriority: medium ms.date: 08/18/2023 -ms.reviewer: -manager: aaroncz -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Configure Windows 10 taskbar diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index c7298fc1d3..2173e2ee20 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -10,7 +10,6 @@ ms.topic: how-to ms.localizationpriority: medium ms.date: 08/18/2023 ms.collection: - - highpri - tier1 ms.technology: itpro-configure --- diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md index 7ef410564c..2e959a035a 100644 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ b/windows/configuration/customize-start-menu-layout-windows-11.md @@ -1,16 +1,9 @@ --- title: Add or remove pinned apps on the Start menu in Windows 11 description: Export Start layout to LayoutModification.json with pinned apps, and add or remove pinned apps. Use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices. -manager: aaroncz author: lizgt2000 ms.author: lizlong ms.reviewer: ericpapa -ms.prod: windows-client -ms.localizationpriority: medium -ms.collection: - - highpri - - tier1 -ms.technology: itpro-configure ms.date: 01/10/2023 ms.topic: article --- diff --git a/windows/configuration/customize-taskbar-windows-11.md b/windows/configuration/customize-taskbar-windows-11.md index a38e34c05c..72a4298b7c 100644 --- a/windows/configuration/customize-taskbar-windows-11.md +++ b/windows/configuration/customize-taskbar-windows-11.md @@ -8,7 +8,6 @@ ms.prod: windows-client author: lizgt2000 ms.localizationpriority: medium ms.collection: - - highpri - tier1 ms.technology: itpro-configure ms.date: 08/17/2023 diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 40b7d5daac..94641458ae 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -3,15 +3,8 @@ title: Customize Windows 10 Start and taskbar with group policy description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. ms.reviewer: manager: aaroncz -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.author: lizlong -ms.topic: article -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index ee9ad89242..5b78101494 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -1,17 +1,10 @@ --- title: Find the Application User Model ID of an installed app ms.reviewer: sybruckm -manager: aaroncz description: To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium -ms.prod: windows-client -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- # Find the Application User Model ID of an installed app diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index f1159c1544..95bcd1a788 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -1,16 +1,10 @@ --- title: Guidelines for choosing an app for assigned access description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience. -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.author: lizlong ms.topic: article ms.reviewer: sybruckm -manager: aaroncz -ms.collection: - - highpri - - tier2 ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index 0eace6a656..6eff88270a 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -9,7 +9,6 @@ metadata: ms.topic: landing-page # Required ms.prod: windows-client ms.collection: - - highpri - tier1 author: aczechowski ms.author: aaroncz diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index e74ea773a1..0218a198e2 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -2,16 +2,11 @@ title: Set up a single-app kiosk on Windows description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions. ms.reviewer: sybruckm -manager: aaroncz ms.author: lizlong -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.topic: article ms.collection: - - highpri - tier1 -ms.technology: itpro-configure ms.date: 07/12/2023 --- diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 82a54e8848..a32e707e87 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,17 +1,10 @@ --- title: Set up a multi-app kiosk on Windows 10 description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. -ms.prod: windows-client -ms.technology: itpro-configure author: lizgt2000 ms.author: lizlong -manager: aaroncz ms.reviewer: sybruckm -ms.localizationpriority: medium ms.topic: how-to -ms.collection: - - highpri - - tier2 ms.date: 11/08/2023 appliesto: - ✅ Windows 10 Pro diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index 5a71baac61..e5fbf3eb4f 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -1,7 +1,6 @@ --- title: Diagnose Provisioning Packages description: Diagnose general failures in provisioning. -ms.reviewer: manager: aaroncz ms.author: lizlong ms.topic: article @@ -9,7 +8,6 @@ ms.prod: windows-client ms.technology: itpro-manage author: lizgt2000 ms.date: 01/18/2023 -ms.collection: highpri --- # Diagnose Provisioning Packages @@ -26,16 +24,16 @@ To apply the power settings successfully with the [correct security context](/wi ## Unable to perform bulk enrollment in Microsoft Entra ID -When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request will be rejected, if the user requesting a bulk token is not authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). +When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). > [!NOTE] -> When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request may be rejected. +> When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected. ## Unable to apply a multivariant provisioning package -When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it may be difficult to diagnose why a certain target did not get applied. There may have been improperly authored conditions that did not evaluate as expected. +When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may have been improperly authored conditions that didn't evaluate as expected. -Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package was not applied. +Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied. You can use the following PowerShell example to review the multivariant conditions in the `MDMDiagReport.xml` report: diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 22b8f9ad65..2f6782646c 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,17 +1,10 @@ --- title: Install Windows Configuration Designer description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11. -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.reviewer: kevinsheehan -manager: aaroncz -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 96dce6d256..aed5ec0d4a 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -2,16 +2,9 @@ title: Provisioning packages overview description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do. ms.reviewer: kevinsheehan -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 9d33ff603e..416187989e 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -1,18 +1,10 @@ --- title: Configure access to Microsoft Store description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: conceptual -ms.localizationpriority: medium ms.date: 11/29/2022 -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Configure access to Microsoft Store diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index a3d8dd29c1..2603aa56ac 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -1,18 +1,10 @@ --- title: Customize and manage the Windows 10 Start and taskbar layout description: On Windows devices, customize the start menu layout and taskbar using XML, group policy, provisioning package, or MDM policy. You can add pinned folders, add a start menu size, pin apps to the taskbar, and more. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.date: 08/05/2021 -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Customize the Start menu and taskbar layout on Windows 10 and later devices diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md index 33bd24bcc8..b80b7b3a66 100644 --- a/windows/configuration/windows-spotlight.md +++ b/windows/configuration/windows-spotlight.md @@ -1,17 +1,10 @@ --- title: Configure Windows Spotlight on the lock screen description: Windows Spotlight is an option for the lock screen background that displays different background images on the lock screen. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.date: 04/30/2018 -ms.collection: - - highpri - - tier2 ms.technology: itpro-configure --- diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 8ad4658ea1..f94f31723e 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -14,7 +14,7 @@ ms.collection: appliesto: - ✅ Windows 10 - ✅ Windows 11 -ms.date: 11/23/2022 +ms.date: 11/14/2023 --- # Deploy Windows Enterprise licenses @@ -306,6 +306,6 @@ If a device isn't able to connect to Windows Update, it can lose activation stat ## Virtual Desktop Access (VDA) -Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another [qualified multitenant hoster](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf) (PDF download). +Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another qualified multitenant hoster. Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. For more information, see [Enable VDA for Enterprise subscription activation](vda-subscription-activation.md). diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 2ab8313425..a0eb436b76 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) ms.prod: windows-client author: frankroj ms.author: frankroj -ms.date: 11/23/2022 +ms.date: 11/16/2023 manager: aaroncz ms.localizationpriority: high ms.topic: how-to @@ -12,19 +12,18 @@ ms.collection: - highpri - tier2 ms.technology: itpro-deploy +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # MBR2GPT.EXE -*Applies to:* +**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows operating system (OS) by using the **`/allowFullOS`** option. -- Windows 10 +**MBR2GPT.EXE** is located in the **`Windows\System32`** directory on a computer running Windows. -**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **`/allowFullOS`** option. - -MBR2GPT.EXE is located in the **`Windows\System32`** directory on a computer running Windows 10 version 1703 or later. - -The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. +The tool is available in both the full OS environment and Windows PE. See the following video for a detailed description and demonstration of MBR2GPT. @@ -33,13 +32,13 @@ See the following video for a detailed description and demonstration of MBR2GPT. You can use MBR2GPT to: - Convert any attached MBR-formatted system disk to the GPT partition format. You can't use the tool to convert non-system disks from MBR to GPT. -- Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you'll need to delete the existing protectors and recreate them. -- Convert operating system disks that have earlier versions of Windows 10 installed, such as versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. -- Convert an operating system disk from MBR to GPT using Configuration Manager or MDT if your task sequence uses Windows PE version 1703 or later. +- Convert an MBR disk with BitLocker-encrypted volumes as long as protection is suspended. To resume BitLocker after conversion, you'll need to delete the existing protectors and recreate them. +- Convert an operating system disk from MBR to GPT using Microsoft Configuration Manager or Microsoft Deployment Toolkit (MDT). -Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 aren't officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion. +Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 aren't officially supported. The recommended method to convert these disks is to upgrade the operating system to a currently supported version of Windows, then perform the MBR to GPT conversion. > [!IMPORTANT] +> > After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode. > > Make sure that your device supports UEFI before attempting to convert the disk. @@ -57,9 +56,9 @@ Before any change to the disk is made, MBR2GPT validates the layout and geometry - The disk doesn't have any extended/logical partition - The BCD store on the system partition contains a default OS entry pointing to an OS partition - The volume IDs can be retrieved for each volume that has a drive letter assigned -- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the /map command-line option +- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the `/map` command-line option -If any of these checks fails, the conversion won't proceed, and an error will be returned. +If any of these checks fails, the conversion doesn't proceed, and an error is returned. ## Syntax @@ -72,9 +71,9 @@ If any of these checks fails, the conversion won't proceed, and an error will be |**/validate**| Instructs `MBR2GPT.exe` to perform only the disk validation steps and report whether the disk is eligible for conversion. | |**/convert**| Instructs `MBR2GPT.exe` to perform the disk validation and to proceed with the conversion if all validation tests pass. | |**/disk:*\***| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| -|**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| +|**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it isn't automatically created or overwritten.| |**/map:*\*=*\***| Specifies other partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | -|**/allowFullOS**| By default, `MBR2GPT.exe` is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
**Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new ESP is created by shrinking the OS partition.| +|**/allowFullOS**| By default, `MBR2GPT.exe` can only run from Windows PE and is blocked from running in full Windows. This option overrides this block and enables disk conversion while running in the full Windows environment.
**Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new EFI system partition is created by shrinking the OS partition.| ## Examples @@ -83,7 +82,7 @@ If any of these checks fails, the conversion won't proceed, and an error will be In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location of **`%windir%`**. ```cmd -X:\>mbr2gpt.exe /validate /disk:0 +X:\> mbr2gpt.exe /validate /disk:0 MBR2GPT: Attempting to validate disk 0 MBR2GPT: Retrieving layout of disk MBR2GPT: Validating layout, disk sector size is: 512 @@ -94,19 +93,24 @@ MBR2GPT: Validation completed successfully In the following example: -1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. +1. The current disk partition layout is displayed prior to conversion using DiskPart - three partitions are present on the MBR disk (disk 0): -2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](/windows/win32/fileio/disk-partition-types) is **07** corresponding to the installable file system (IFS) type. + - A system reserved partition. + - A Windows partition. + - A recovery partition. + - A DVD-ROM is also present as volume 0. -3. The MBR2GPT tool is used to convert disk 0. +1. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](/windows/win32/fileio/disk-partition-types) is **07** corresponding to the installable file system (IFS) type. -4. The DiskPart tool displays that disk 0 is now using the GPT format. +1. The MBR2GPT tool is used to convert disk 0. -5. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). +1. The DiskPart tool displays that disk 0 is now using the GPT format. -6. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. +1. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. +1. The OS volume is selected again. The detail displays that the OS volume is converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. + +As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition boots properly.

@@ -240,42 +244,44 @@ Offset in Bytes: 524288000 The following steps illustrate high-level phases of the MBR-to-GPT conversion process: 1. Disk validation is performed. -2. The disk is repartitioned to create an EFI system partition (ESP) if one doesn't already exist. -3. UEFI boot files are installed to the ESP. +2. The disk is repartitioned to create an EFI system partition if one doesn't already exist. +3. UEFI boot files are installed to the EFI system partition. 4. GPT metadata and layout information are applied. 5. The boot configuration data (BCD) store is updated. 6. Drive letter assignments are restored. ### Creating an EFI system partition -For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules: +For Windows to remain bootable after the conversion, an EFI system partition must be in place. MBR2GPT creates the EFI system partition using the following rules: 1. The existing MBR system partition is reused if it meets these requirements: - 1. It isn't also the OS or Windows Recovery Environment partition. - 1. It is at least 100 MB (or 260 MB for 4K sector size disks) in size. - 1. It's less than or equal to 1 GB in size. This size is a safety precaution to ensure it isn't a data partition. - 1. The conversion isn't being performed from the full OS. In this case, the existing MBR system partition is in use and can't be repurposed. -2. If the existing MBR system partition can't be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100 MB (or 260 MB for 4K sector size disks) and is formatted FAT32. + - It isn't also the OS or Windows Recovery Environment partition. + - It is at least 100 MB (or 260 MB for 4K sector size disks) in size. + - It's less than or equal to 1 GB in size. This size is a safety precaution to ensure it isn't a data partition. + - The conversion isn't being performed from the full OS. In this case, the existing MBR system partition is in use and can't be repurposed. -If the existing MBR system partition isn't reused for the ESP, it's no longer used by the boot process after the conversion. Other partitions aren't modified. +2. If the existing MBR system partition can't be reused, a new EFI system partition is created by shrinking the OS partition. This new partition has a size of 100 MB (or 260 MB for 4K sector size disks) and is formatted FAT32. ->[!IMPORTANT] ->If the existing MBR system partition is not reused for the ESP, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. +If the existing MBR system partition isn't reused for the EFI system partition, it's no longer used by the boot process after the conversion. Other partitions aren't modified. + +> [!IMPORTANT] +> +> If the existing MBR system partition is not reused for the EFI system partition, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. ### Partition type mapping and partition attributes Since GPT partitions use a different set of type IDs than MBR partitions, each partition on the converted disk must be assigned a new type ID. The partition type mapping follows these rules: -1. The ESP is always set to partition type PARTITION_SYSTEM_GUID (c12a7328-f81f-11d2-ba4b-00a0c93ec93b). -2. If an MBR partition is of a type that matches one of the entries specified in the /map switch, the specified GPT partition type ID is used. -3. If the MBR partition is of type 0x27, the partition is converted to a GPT partition of type PARTITION_MSFT_RECOVERY_GUID (de94bba4-06d1-4d40-a16a-bfd50179d6ac). -4. All other MBR partitions recognized by Windows are converted to GPT partitions of type PARTITION_BASIC_DATA_GUID (ebd0a0a2-b9e5-4433-87c0-68b6b72699c7). +1. The EFI system partition is always set to partition type **PARTITION_SYSTEM_GUID** (**c12a7328-f81f-11d2-ba4b-00a0c93ec93b**). +2. If an MBR partition is of a type that matches one of the entries specified in the `/map` switch, the specified GPT partition type ID is used. +3. If the MBR partition is of type **0x27**, the partition is converted to a GPT partition of type **PARTITION_MSFT_RECOVERY_GUID** (**de94bba4-06d1-4d40-a16a-bfd50179d6ac**). +4. All other MBR partitions recognized by Windows are converted to GPT partitions of type **PARTITION_BASIC_DATA_GUID** (**ebd0a0a2-b9e5-4433-87c0-68b6b72699c7**). In addition to applying the correct partition types, partitions of type PARTITION_MSFT_RECOVERY_GUID also have the following GPT attributes set: -- GPT_ATTRIBUTE_PLATFORM_REQUIRED (0x0000000000000001) -- GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER (0x8000000000000000) +- **GPT_ATTRIBUTE_PLATFORM_REQUIRED** (**0x0000000000000001**) +- **GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER** (**0x8000000000000000**) For more information about partition types, see: @@ -284,20 +290,21 @@ For more information about partition types, see: ### Persisting drive letter assignments -The conversion tool will attempt to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. +The conversion tool attempts to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error is displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. > [!IMPORTANT] +> > This code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. -The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following: +The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It then iterates through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry it does the following: -1. Check if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. +1. Checks if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. 2. If found, set the value to be the new unique ID, obtained after the layout conversion. -3. If the new unique ID can't be set and the value name starts with \DosDevices, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. +3. If the new unique ID can't be set and the value name starts with **\DosDevices**, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. ## Troubleshooting -The tool will display status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions don't translate properly, this is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). +The tool displays status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions don't translate properly, this information is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). ### Logs @@ -308,16 +315,21 @@ Four log files are created by the MBR2GPT tool: - setupact.log - setuperr.log -These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. +These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The `setupact.log` and `setuperr.log` files have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. > [!NOTE] -> The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory. +> +> The **setupact*.log** files are different than the Windows Setup files that are found in the `%Windir%\Panther` directory. The default location for all these log files in Windows PE is **%windir%**. ### Interactive help -To view a list of options available when using the tool, enter **`mbr2gpt.exe /?`** +To view a list of options available when using the tool, enter the following command in an elevated command prompt: + +```cmd +mbr2gpt.exe /? +``` The following text is displayed: @@ -378,7 +390,21 @@ MBR2GPT has the following associated return codes: ### Determining the partition type -You can type the following command at a Windows PowerShell prompt to display the disk number and partition type. Example output is also shown: +The partition type can be determined in one of three ways: + +- Using Windows PowerShell +- Using the Disk Management tool +- Using the DiskPart tool + +#### Windows PowerShell + +You can enter the following command at a Windows PowerShell prompt to display the disk number and partition type: + +```powershell +Get-Disk | ft -Auto +`````` + +Example output: ```powershell PS C:\> Get-Disk | ft -Auto @@ -389,11 +415,43 @@ Number Friendly Name Serial Number HealthStatus OperationalStatus To 1 ST1000DM003-1ER162 Z4Y3GD8F Healthy Online 931.51 GB GPT ``` -You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example: +#### Disk Management tool -:::image type="content" alt-text="Volumes." source="images/mbr2gpt-volume.png"::: +You can view the partition type of a disk by using the Disk Management tool: -If Windows PowerShell and Disk Management aren't available, such as when you're using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: +1. Right-click on the Start Menu and select **Disk Management**. Alternatively, right-click on the Start Menu and select **Run**. In the **Run** dialog box that appears, enter `diskmgmt.msc` and then select **OK**. + +1. In the **Disk Management** window that appears: + + 1. On the bottom pane, select the disk number of interest. + + 1. Select the **Action** menu and then select **All Tasks > Properties**. Alternatively, right-click on the disk number of interest and select **Properties**. + + 1. In the **Properties** dialog box that appears for the disk, select the **Volumes** tab. + + 1. Under the **Volumes** tab, the partition type is displayed next to **Partition style:**. + +#### DiskPart tool + +The partition type can be determined with the DiskPart tool. The DiskPart tool is useful in scenarios where the Disk Management tool and PowerShell aren't available, such as in WinPE. PowerShell isn't available in WinPE when the PowerShell optional component isn't loaded. To use the DiskPart tool to determine the partition type: + +1. Open an elevated command prompt. + +1. In the elevated command prompt that opens enter the following command: + + ```cmd + DiskPart.exe + ``` + +1. The **DISKPART>** prompt is displayed in the command prompt windows. At the **DISKPART>** prompt, enter the following command: + + ```cmd + list disk + ``` + +1. The partition type is displayed in the **Gpt** column. If the partition is GPT, an asterisk (**\***) is displayed in the column. If the partition is MBR, the column is blank. + +The following shows an example output of the DiskPart tool showing the partition type for two disks: ```cmd X:\>DiskPart.exe @@ -412,66 +470,3 @@ DISKPART> list disk ``` In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT. - -## Known issue - -### MBR2GPT.exe can't run in Windows PE - -When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues: - -**Issue 1** When you run the `MBR2GPT.exe` command, the process exits without converting the drive. - -**Issue 2** When you manually run the `MBR2GPT.exe` command in a Command Prompt window, there's no output from the tool. - -**Issue 3** When `MBR2GPT.exe` runs inside an imaging process such as a Microsoft Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. - -#### Cause - -This issue occurs because in Windows 10, version 1903 and later versions, `MBR2GPT.exe` requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. - -#### Workaround - -To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. Use follow these steps: - -1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). - -2. Copy the ReAgent files and the ReAgent localization files from the Windows 10, version 1903 ADK source folder to the mounted WIM. - - For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: - - > [!NOTE] - > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit. - - **Command 1:** - - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" - ``` - - This command copies three files: - - - ReAgent.admx - - ReAgent.dll - - ReAgent.xml - - **Command 2:** - - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" - ``` - - This command copies two files: - - - ReAgent.adml - - ReAgent.dll.mui - - > [!NOTE] - > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. - -3. After you copy all the files, commit the changes and unmount the Windows PE WIM. `MBR2GPT.exe` now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). - -## Related articles - -[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 840ea3d5a7..05c5f63d80 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -9,9 +9,8 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: medium appliesto: -- ✅ Windows 11 - ✅ Windows 10 -ms.date: 12/31/2017 +ms.date: 11/16/2023 --- # Configure BranchCache for Windows client updates @@ -33,7 +32,10 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](/previous-versions/windows/it-pro/windows-7/dd637820(v=ws.10)) in the [BranchCache Early Adopter's Guide](/previous-versions/windows/it-pro/windows-7/dd637762(v=ws.10)). -In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. +In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization **Download mode** to '100' (Bypass) to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. + +> [!Note] +> Setting [Download mode](../do/waas-delivery-optimization-reference.md#download-mode) to '100' (Bypass) is only available in Windows 10, version 1607 and later, not in Windows 11. BranchCache isn't supported for Windows 11. ## Configure servers for BranchCache diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index df89fc602d..aefcd10aa4 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -9,7 +9,7 @@ ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.topic: how-to -ms.date: 11/23/2022 +ms.date: 11/14/2023 --- # Configure VDA for Windows subscription activation @@ -31,7 +31,7 @@ Deployment instructions are provided for the following scenarios: - VMs must be running a supported version of Windows Pro edition. - VMs must be joined to Active Directory or Microsoft Entra ID. -- VMs must be hosted by a Qualified Multitenant Hoster (QMTH). For more information, download the PDF that describes the [Qualified Multitenant Hoster Program](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). +- VMs must be hosted by a Qualified Multitenant Hoster (QMTH). ## Activation diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 40769fc671..11b304e822 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -225,26 +225,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf > [!IMPORTANT] > Don't attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, don't start the VM outside the PoC network. -If you don't have a PC available to convert to VM, do the following steps to download an evaluation VM: - -1. Open the [Download virtual machines](https://developer.microsoft.com/microsoft-edge/tools/vms/) page. - - > [!NOTE] - > The above link may not be available in all locales. - -2. Under **Virtual machine**, choose **IE11 on Win7**. - -3. Under **Select platform**, choose **HyperV (Windows)**. - -4. Select **Download .zip**. The download is 3.31 GB. - -5. Extract the zip file. Three directories are created. - -6. Open the **Virtual Hard Disks** directory and then copy **IE11 - Win7.vhd** to the **C:\VHD** directory. - -7. Rename **IE11 - Win7.vhd** to **w7.vhd** (don't rename the file to w7.vhdx). - -8. In step 5 of the [Configure Hyper-V](#configure-hyper-v) section, replace the VHD file name **w7.vhdx** with **w7.vhd**. + If you have a PC available to convert to VM (computer 2): diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 6b8718bf68..b5fc8eb923 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -11,7 +11,7 @@ ms.collection: - highpri - tier2 ms.topic: conceptual -ms.date: 11/23/2022 +ms.date: 11/14/2023 appliesto: - ✅ Windows 10 - ✅ Windows 11 @@ -39,7 +39,15 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). > [!NOTE] -> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude the [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications), from their Conditional Access policies using **Select Excluded Cloud Apps**. For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions). +> +> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**: +> +> - [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). +> - [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). +> +> Although the app ID is the same in both instances, the name of the cloud app will depend on the tenant. +> +> For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions). ## Subscription activation for Enterprise @@ -239,7 +247,7 @@ For more information, see [Deploy Windows Enterprise licenses](deploy-enterprise ## Virtual Desktop Access (VDA) -Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Microsoft Azure or in another [qualified multitenant hoster (QMTH)](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). +Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Microsoft Azure or in another qualified multitenant hoster (QMTH). Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index eb2f5d26d5..e41d8e60f4 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -1,7 +1,7 @@ --- title: Post-device registration readiness checks description: This article details how post-device registration readiness checks are performed in Windows Autopatch -ms.date: 09/16/2022 +ms.date: 09/16/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md index e68ee4d6bd..71b96ec441 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md @@ -1,7 +1,7 @@ --- title: Quality update trending report description: Provides a visual representation of the update status trend for all devices over the last 90 days with Autopatch groups. -ms.date: 05/01/2023 +ms.date: 09/01/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md index 3b72dc6d90..fe9d6b3321 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md @@ -1,7 +1,7 @@ --- title: Maintain the Windows Autopatch environment description: This article details how to maintain the Windows Autopatch environment -ms.date: 05/15/2023 +ms.date: 09/15/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index 690e61a507..20c341551a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -1,7 +1,7 @@ --- title: Submit a support request description: Details how to contact the Windows Autopatch Service Engineering Team and submit support requests -ms.date: 01/06/2023 +ms.date: 09/06/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index 043db6fb77..0e481d7a66 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -1,7 +1,7 @@ --- title: Privacy description: This article provides details about the data platform and privacy compliance for Autopatch -ms.date: 03/13/2023 +ms.date: 09/13/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: reference diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md index 6588ea5a13..bc26753af7 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md @@ -1,7 +1,7 @@ --- title: Submit a tenant enrollment support request description: This article details how to submit a tenant enrollment support request -ms.date: 01/13/2023 +ms.date: 09/13/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 8acdf328e5..f7a2045294 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -1,7 +1,7 @@ --- title: Fix issues found by the Readiness assessment tool description: This article details how to fix issues found by the Readiness assessment tool. -ms.date: 01/12/2023 +ms.date: 09/12/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index b0df16842e..7cb1b4a4d5 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -1,7 +1,7 @@ --- title: Prerequisites description: This article details the prerequisites needed for Windows Autopatch -ms.date: 04/24/2023 +ms.date: 09/24/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md index 9ece385c03..e72d9e8042 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md @@ -1,7 +1,7 @@ --- title: Windows update policies description: This article explains Windows update policies in Windows Autopatch -ms.date: 12/02/2022 +ms.date: 09/02/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 24650e3a33..1e7b26a9c9 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 10/27/2023 +ms.date: 11/16/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -21,6 +21,14 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## November 2023 + +## November service release + +| Message center post number | Description | +| ----- | ----- | +| [MC689492](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Planned Maintenance: Service maintenance to improve Windows Autopatch performance | + ## October 2023 ### October feature releases or updates diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 7c0031c1e0..e651c1901d 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -10,7 +10,6 @@ metadata: ms.topic: hub-page ms.prod: windows-client ms.collection: - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 2e4ec8b5e5..fa5d96ef91 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -1,9 +1,6 @@ --- title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. -ms.collection: - - highpri - - tier2 ms.topic: concept-article ms.date: 05/24/2023 --- diff --git a/windows/security/application-security/application-control/user-account-control/index.md b/windows/security/application-security/application-control/user-account-control/index.md index aad3fb9eab..3b5e6e8561 100644 --- a/windows/security/application-security/application-control/user-account-control/index.md +++ b/windows/security/application-security/application-control/user-account-control/index.md @@ -1,9 +1,6 @@ --- title: User Account Control description: Learn how User Account Control (UAC) helps to prevent unauthorized changes to Windows devices. -ms.collection: - - highpri - - tier2 ms.topic: overview ms.date: 05/24/2023 --- diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md index 7c130ac1f2..8bc7a51202 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md @@ -2,7 +2,6 @@ title: AppLocker description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.collection: -- highpri - tier3 - must-keep ms.topic: conceptual diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 3eac346b20..615226657c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -3,7 +3,6 @@ title: Microsoft recommended driver block rules description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. ms.localizationpriority: medium ms.collection: -- highpri - tier3 - must-keep ms.date: 06/06/2023 diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md index 22e5196913..500f4c397b 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md @@ -3,7 +3,6 @@ title: Application Control for Windows description: Application Control restricts which applications users are allowed to run and the code that runs in the system core. ms.localizationpriority: medium ms.collection: -- highpri - tier3 - must-keep ms.date: 08/30/2023 diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md index ac710efb7a..5deab8192a 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md @@ -3,9 +3,6 @@ title: Enable hardware-based isolation for Microsoft Edge description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. ms.date: 07/11/2023 ms.topic: how-to -ms.collection: - - highpri - - tier2 --- # Prepare to install Microsoft Defender Application Guard diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md index d1547ce21e..8b2235111a 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md @@ -1,11 +1,7 @@ --- title: Microsoft Defender Application Guard description: Learn about Microsoft Defender Application Guard and how it helps combat malicious content and malware out on the Internet. -ms.localizationpriority: medium ms.date: 07/11/2023 -ms.collection: - - highpri - - tier2 ms.topic: conceptual --- diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 888bca39ce..b33a5b9f67 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -1,9 +1,6 @@ --- title: Windows Sandbox configuration description: Windows Sandbox configuration -ms.collection: - - highpri - - tier2 ms.topic: article ms.date: 05/25/2023 --- diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md index 928d31e27b..676b2a8179 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md @@ -1,9 +1,6 @@ --- title: Windows Sandbox description: Windows Sandbox overview -ms.collection: - - highpri - - tier2 ms.topic: article ms.date: 05/25/2023 --- diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 7421416038..4dffa28451 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -222,14 +222,12 @@ "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck" }, "ms.collection": { - "application-security/application-control/windows-defender-application-control/**/*.md": [ "tier3", "must-keep" ], "identity-protection/hello-for-business/*.md": "tier1", "information-protection/pluton/*.md": "tier1", "information-protection/tpm/*.md": "tier1", "threat-protection/auditing/*.md": "tier3", "operating-system-security/data-protection/bitlocker/*.md": "tier1", - "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1", - "operating-system-security/network-security/windows-firewall/*.md": [ "tier2", "must-keep" ] + "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1" } }, "template": [], diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index a3404e644a..2748c9c816 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -1,10 +1,6 @@ --- title: Enable memory integrity description: This article explains the steps to opt in to using memory integrity on Windows devices. -ms.localizationpriority: medium -ms.collection: - - highpri - - tier2 ms.topic: conceptual ms.date: 03/16/2023 appliesto: diff --git a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md index 8ed52be240..f4092a1bc3 100644 --- a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md @@ -2,7 +2,6 @@ title: Kernel DMA Protection description: Learn how Kernel DMA Protection protects Windows devices against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices. ms.collection: - - highpri - tier1 ms.topic: conceptual ms.date: 07/31/2023 diff --git a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md index 11e1b60887..13fb26b05c 100644 --- a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -4,7 +4,6 @@ description: Learn how to view and troubleshoot the Trusted Platform Module (TPM ms.topic: conceptual ms.date: 11/17/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index 4fc8d8e9ae..4471400a65 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -4,7 +4,6 @@ description: This topic provides recommendations for Trusted Platform Module (TP ms.topic: conceptual ms.date: 11/17/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md index fd028ba8e4..46a0c61d51 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md @@ -4,7 +4,6 @@ description: Learn about the Trusted Platform Module (TPM) and how Windows uses ms.topic: conceptual ms.date: 11/17/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/identity-protection/credential-guard/configure.md b/windows/security/identity-protection/credential-guard/configure.md index 21c87bfeeb..e6e9d95ed6 100644 --- a/windows/security/identity-protection/credential-guard/configure.md +++ b/windows/security/identity-protection/credential-guard/configure.md @@ -2,9 +2,6 @@ title: Configure Credential Guard description: Learn how to configure Credential Guard using MDM, Group Policy, or the registry. ms.date: 08/31/2023 -ms.collection: - - highpri - - tier2 ms.topic: how-to --- diff --git a/windows/security/identity-protection/credential-guard/index.md b/windows/security/identity-protection/credential-guard/index.md index 710f148343..0fe80abdd8 100644 --- a/windows/security/identity-protection/credential-guard/index.md +++ b/windows/security/identity-protection/credential-guard/index.md @@ -3,9 +3,6 @@ title: Credential Guard overview description: Learn about Credential Guard and how it isolates secrets so that only privileged system software can access them. ms.date: 08/31/2023 ms.topic: overview -ms.collection: - - highpri - - tier1 --- # Credential Guard overview diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 8a414df385..830d49e11a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -1,9 +1,6 @@ --- title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario -ms.collection: -- highpri -- tier1 ms.date: 09/07/2023 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 315ce4361f..420aee5ed1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -1,8 +1,6 @@ --- title: Deploy certificates for remote desktop sign-in description: Learn how to deploy certificates to cloud Kerberos trust and key trust users, to enable remote desktop sign-in with supplied credentials. -ms.collection: - - tier1 ms.topic: how-to ms.date: 07/25/2023 --- diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 661971662b..4f52648ad3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -4,9 +4,6 @@ metadata: description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. author: paolomatarazzo ms.author: paoloma - ms.collection: - - highpri - - tier1 ms.topic: faq ms.date: 08/03/2023 diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index bf642eef73..5dda9f66b2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -1,9 +1,6 @@ --- title: PIN reset description: Learn how Microsoft PIN reset service enables your users to recover a forgotten Windows Hello for Business PIN. -ms.collection: - - highpri - - tier1 ms.date: 08/15/2023 ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 8e7e89b38e..d7d52bf8c8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -3,8 +3,6 @@ title: Remote Desktop description: Learn how Windows Hello for Business supports using biometrics with remote desktop ms.date: 09/01/2023 ms.topic: conceptual -ms.collection: -- tier1 --- # Remote Desktop diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index ea4c5a3119..61dffe9d37 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -3,8 +3,6 @@ ms.date: 10/09/2023 title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.topic: overview -ms.collection: -- tier1 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 999b35f45b..896453d0bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -1,9 +1,6 @@ --- title: Manage Windows Hello in your organization description: Learn how to create a Group Policy or mobile device management (MDM) policy to configure and deploy Windows Hello for Business. -ms.collection: - - highpri - - tier1 ms.date: 9/25/2023 ms.topic: reference --- diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index f137de379f..6be7e8008f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -1,9 +1,6 @@ --- title: Why a PIN is better than an online password description: Windows Hello enables users to sign in to their devices using a PIN. Learn how is a PIN different from (and better than) an online password. -ms.collection: - - highpri - - tier1 ms.date: 03/15/2023 ms.topic: conceptual --- diff --git a/windows/security/identity-protection/hello-for-business/index.md b/windows/security/identity-protection/hello-for-business/index.md index 953074993d..e0be2b5b93 100644 --- a/windows/security/identity-protection/hello-for-business/index.md +++ b/windows/security/identity-protection/hello-for-business/index.md @@ -1,9 +1,6 @@ --- title: Windows Hello for Business Overview description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices. -ms.collection: - - highpri - - tier1 ms.topic: overview ms.date: 04/24/2023 --- diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index 9ca4657426..44f695a852 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -2,7 +2,6 @@ title: Support for passkeys in Windows description: Learn about passkeys and how to use them on Windows devices. ms.collection: -- highpri - tier1 ms.topic: overview ms.date: 11/07/2023 diff --git a/windows/security/identity-protection/passwordless-experience/index.md b/windows/security/identity-protection/passwordless-experience/index.md index 7ea73c4603..37dc49c775 100644 --- a/windows/security/identity-protection/passwordless-experience/index.md +++ b/windows/security/identity-protection/passwordless-experience/index.md @@ -2,7 +2,6 @@ title: Windows passwordless experience description: Learn how Windows passwordless experience enables your organization to move away from passwords. ms.collection: - - highpri - tier1 ms.date: 09/27/2023 ms.topic: how-to diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 5c99653fe4..2b0d64ce57 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -1,11 +1,8 @@ --- title: Remote Credential Guard description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device. -ms.collection: -- highpri -- tier1 ms.topic: how-to -ms.date: 09/06/2023 +ms.date: 11/17/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -133,7 +130,7 @@ reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin To enable Remote Credential Guard on the clients, you can configure a policy that prevents the delegation of credentials to the remote hosts. > [!TIP] -> If you don't want to configure your clients to enforce Remote Credential Guard, you can use the following command to use Remote Credential Guard for a specific RDP session: +> If you don't want to configure your clients to enforce Remote Credential Guard, and if you are an administrator of the remote host, you can use the following command to use Remote Credential Guard for a specific RDP session: > ```cmd > mstsc.exe /remoteGuard > ``` diff --git a/windows/security/identity-protection/web-sign-in/index.md b/windows/security/identity-protection/web-sign-in/index.md index ecf5811f4d..d2d61e204a 100644 --- a/windows/security/identity-protection/web-sign-in/index.md +++ b/windows/security/identity-protection/web-sign-in/index.md @@ -6,7 +6,6 @@ ms.topic: how-to appliesto: - ✅ Windows 11 ms.collection: - - highpri - tier1 --- diff --git a/windows/security/index.yml b/windows/security/index.yml index 40983d837f..7433169832 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -9,7 +9,6 @@ metadata: ms.prod: windows-client ms.technology: itpro-security ms.collection: - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md index 6b192f2171..5f18fd26da 100644 --- a/windows/security/licensing-and-edition-requirements.md +++ b/windows/security/licensing-and-edition-requirements.md @@ -1,8 +1,6 @@ --- title: Windows security features licensing and edition requirements description: Learn about Windows licensing and edition requirements for the features included in Windows. -ms.collection: -- tier2 ms.topic: conceptual ms.date: 06/15/2023 appliesto: diff --git a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml index 3973bbbe52..e67401c81a 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml +++ b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml @@ -1,9 +1,7 @@ ### YamlMime:FAQ metadata: title: BitLocker FAQ - description: Learn more about BitLocker by reviewing the frequently asked questions. - ms.collection: - - tier1 + description: Learn more about BitLocker by reviewing the frequently asked questions. ms.topic: faq ms.date: 10/30/2023 title: BitLocker FAQ diff --git a/windows/security/operating-system-security/data-protection/bitlocker/index.md b/windows/security/operating-system-security/data-protection/bitlocker/index.md index c831cf49df..9d9ff5daed 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/index.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/index.md @@ -1,9 +1,6 @@ --- title: BitLocker overview description: Learn about BitLocker practical applications and requirements. -ms.collection: - - highpri - - tier1 ms.topic: overview ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md index bdbd2a6e80..380ac306c4 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md @@ -1,8 +1,6 @@ --- title: BitLocker operations guide description: Learn how to use different tools to manage and operate BitLocker. -ms.collection: - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md index e694a95993..78ab928ae2 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md @@ -1,9 +1,6 @@ --- title: BitLocker preboot recovery screen description: Learn about the information displayed in the BitLocker preboot recovery screen, depending on configured policy settings and recovery keys status. -ms.collection: - - highpri - - tier1 ms.topic: concept-article ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md index d258db515e..a8446d34d2 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md @@ -1,9 +1,6 @@ --- title: BitLocker recovery overview description: Learn about BitLocker recovery scenarios, recovery options, and how to determine root cause of failed automatic unlocks. -ms.collection: - - highpri - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index 76c314a7cb..b002833d87 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -1,9 +1,6 @@ --- title: BitLocker recovery process description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive. -ms.collection: - - highpri - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md index 0376d87c85..fa66e1ee5c 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -1,10 +1,6 @@ --- title: Microsoft Security Compliance Toolkit Guide description: This article describes how to use Security Compliance Toolkit in your organization. -ms.localizationpriority: medium -ms.collection: - - highpri - - tier3 ms.topic: conceptual ms.date: 10/31/2023 --- diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md index 63b6cae99b..851c7a72c1 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md @@ -1,10 +1,6 @@ --- title: Security baselines guide description: Learn how to use security baselines in your organization. -ms.localizationpriority: medium -ms.collection: - - highpri - - tier3 ms.topic: conceptual ms.date: 07/11/2023 --- diff --git a/windows/security/operating-system-security/network-security/toc.yml b/windows/security/operating-system-security/network-security/toc.yml index 9745213bd4..713ead1e6c 100644 --- a/windows/security/operating-system-security/network-security/toc.yml +++ b/windows/security/operating-system-security/network-security/toc.yml @@ -7,8 +7,8 @@ items: href: https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09 - name: Extensible Authentication Protocol (EAP) for network access href: /windows-server/networking/technologies/extensible-authentication-protocol/network-access - - name: Windows Firewall 🔗 - href: windows-firewall/windows-firewall-with-advanced-security.md + - name: Windows Firewall + href: windows-firewall/toc.yml - name: Virtual Private Network (VPN) href: vpn/toc.yml - name: Always On VPN 🔗 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml deleted file mode 100644 index 3914108b37..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ /dev/null @@ -1,254 +0,0 @@ -items: - - name: Overview - href: windows-firewall-with-advanced-security.md - - name: Plan deployment - items: - - name: Design guide - href: windows-firewall-with-advanced-security-design-guide.md - - name: Design process - href: understanding-the-windows-firewall-with-advanced-security-design-process.md - - name: Implementation goals - items: - - name: Identify implementation goals - href: identifying-your-windows-firewall-with-advanced-security-deployment-goals.md - - name: Protect devices from unwanted network traffic - href: protect-devices-from-unwanted-network-traffic.md - - name: Restrict access to only trusted devices - href: restrict-access-to-only-trusted-devices.md - - name: Require encryption - href: require-encryption-when-accessing-sensitive-network-resources.md - - name: Restrict access - href: restrict-access-to-only-specified-users-or-devices.md - - name: Implementation designs - items: - - name: Map goals to a design - href: mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md - - name: Basic firewall design - href: basic-firewall-policy-design.md - items: - - name: Basic firewall design example - href: firewall-policy-design-example.md - - name: Domain isolation design - href: domain-isolation-policy-design.md - items: - - name: Domain isolation design example - href: domain-isolation-policy-design-example.md - - name: Server isolation design - href: server-isolation-policy-design.md - items: - - name: Server Isolation design example - href: server-isolation-policy-design-example.md - - name: Certificate-based isolation design - href: certificate-based-isolation-policy-design.md - items: - - name: Certificate-based Isolation design example - href: certificate-based-isolation-policy-design-example.md - - name: Design planning - items: - - name: Plan your design - href: planning-your-windows-firewall-with-advanced-security-design.md - - name: Plan settings for a basic firewall policy - href: planning-settings-for-a-basic-firewall-policy.md - - name: Plan domain isolation zones - items: - - name: Domain isolation zones - href: planning-domain-isolation-zones.md - - name: Exemption list - href: exemption-list.md - - name: Isolated domain - href: isolated-domain.md - - name: Boundary zone - href: boundary-zone.md - - name: Encryption zone - href: encryption-zone.md - - name: Plan server isolation zones - href: planning-server-isolation-zones.md - - name: Plan certificate-based authentication - href: planning-certificate-based-authentication.md - items: - - name: Document the Zones - href: documenting-the-zones.md - - name: Plan group policy deployment for your isolation zones - href: planning-group-policy-deployment-for-your-isolation-zones.md - items: - - name: Plan isolation groups for the zones - href: planning-isolation-groups-for-the-zones.md - - name: Plan network access groups - href: planning-network-access-groups.md - - name: Plan the GPOs - href: planning-the-gpos.md - items: - - name: Firewall GPOs - href: firewall-gpos.md - items: - - name: GPO_DOMISO_Firewall - href: gpo-domiso-firewall.md - - name: Isolated domain GPOs - href: isolated-domain-gpos.md - items: - - name: GPO_DOMISO_IsolatedDomain_Clients - href: gpo-domiso-isolateddomain-clients.md - - name: GPO_DOMISO_IsolatedDomain_Servers - href: gpo-domiso-isolateddomain-servers.md - - name: Boundary zone GPOs - href: boundary-zone-gpos.md - items: - - name: GPO_DOMISO_Boundary - href: gpo-domiso-boundary.md - - name: Encryption zone GPOs - href: encryption-zone-gpos.md - items: - - name: GPO_DOMISO_Encryption - href: gpo-domiso-encryption.md - - name: Server isolation GPOs - href: server-isolation-gpos.md - - name: Plan GPO deployment - href: planning-gpo-deployment.md - - name: Plan to deploy - href: planning-to-deploy-windows-firewall-with-advanced-security.md - - name: Deployment guide - items: - - name: Deployment overview - href: windows-firewall-with-advanced-security-deployment-guide.md - - name: Implement your plan - href: implementing-your-windows-firewall-with-advanced-security-design-plan.md - - name: Basic firewall deployment - items: - - name: "Checklist: Implement a basic firewall policy design" - href: checklist-implementing-a-basic-firewall-policy-design.md - - name: Domain isolation deployment - items: - - name: "Checklist: Implement a Domain Isolation Policy Design" - href: checklist-implementing-a-domain-isolation-policy-design.md - - name: Server isolation deployment - items: - - name: "Checklist: Implement a Standalone Server Isolation Policy Design" - href: checklist-implementing-a-standalone-server-isolation-policy-design.md - - name: Certificate-based authentication - items: - - name: "Checklist: Implement a Certificate-based Isolation Policy Design" - href: checklist-implementing-a-certificate-based-isolation-policy-design.md - - name: Best practices - items: - - name: Configure the firewall - href: best-practices-configuring.md - - name: Secure IPsec - href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - - name: PowerShell - href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - - name: Isolate Microsoft Store Apps on Your Network - href: isolating-apps-on-your-network.md - - name: How-to - items: - - name: Add Production devices to the membership group for a zone - href: add-production-devices-to-the-membership-group-for-a-zone.md - - name: Add test devices to the membership group for a zone - href: add-test-devices-to-the-membership-group-for-a-zone.md - - name: Assign security group filters to the GPO - href: assign-security-group-filters-to-the-gpo.md - - name: Change rules from request to require mode - href: Change-Rules-From-Request-To-Require-Mode.Md - - name: Configure authentication methods - href: Configure-authentication-methods.md - - name: Configure data protection (Quick Mode) settings - href: configure-data-protection-quick-mode-settings.md - - name: Configure Group Policy to autoenroll and deploy certificates - href: configure-group-policy-to-autoenroll-and-deploy-certificates.md - - name: Configure Hyper-V firewall - href: hyper-v-firewall.md - - name: Configure key exchange (main mode) settings - href: configure-key-exchange-main-mode-settings.md - - name: Configure the rules to require encryption - href: configure-the-rules-to-require-encryption.md - - name: Configure the Windows Firewall log - href: configure-the-windows-firewall-log.md - - name: Configure the workstation authentication certificate template - href: configure-the-workstation-authentication-certificate-template.md - - name: Configure Windows Firewall to suppress notifications when a program is blocked - href: configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md - - name: Confirm that certificates are deployed correctly - href: confirm-that-certificates-are-deployed-correctly.md - - name: Copy a GPO to create a new GPO - href: copy-a-gpo-to-create-a-new-gpo.md - - name: Create a Group Account in Active Directory - href: create-a-group-account-in-active-directory.md - - name: Create a Group Policy Object - href: create-a-group-policy-object.md - - name: Create an authentication exemption list rule - href: create-an-authentication-exemption-list-rule.md - - name: Create an authentication request rule - href: create-an-authentication-request-rule.md - - name: Create an inbound ICMP rule - href: create-an-inbound-icmp-rule.md - - name: Create an inbound port rule - href: create-an-inbound-port-rule.md - - name: Create an inbound program or service rule - href: create-an-inbound-program-or-service-rule.md - - name: Create an outbound port rule - href: create-an-outbound-port-rule.md - - name: Create an outbound program or service rule - href: create-an-outbound-program-or-service-rule.md - - name: Create inbound rules to support RPC - href: create-inbound-rules-to-support-rpc.md - - name: Create WMI filters for the GPO - href: create-wmi-filters-for-the-gpo.md - - name: Create Windows Firewall rules in Intune - href: create-windows-firewall-rules-in-intune.md - - name: Enable predefined inbound rules - href: enable-predefined-inbound-rules.md - - name: Enable predefined outbound rules - href: enable-predefined-outbound-rules.md - - name: Exempt ICMP from authentication - href: exempt-icmp-from-authentication.md - - name: Link the GPO to the domain - href: link-the-gpo-to-the-domain.md - - name: Modify GPO filters - href: modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md - - name: Open IP security policies - href: open-the-group-policy-management-console-to-ip-security-policies.md - - name: Open Group Policy - href: open-the-group-policy-management-console-to-windows-firewall.md - - name: Open Group Policy - href: open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md - - name: Open Windows Firewall - href: open-windows-firewall-with-advanced-security.md - - name: Restrict server access - href: restrict-server-access-to-members-of-a-group-only.md - - name: Enable Windows Firewall - href: turn-on-windows-firewall-and-configure-default-behavior.md - - name: Verify Network Traffic - href: verify-that-network-traffic-is-authenticated.md - - name: References - items: - - name: "Checklist: Create Group Policy objects" - href: checklist-creating-group-policy-objects.md - - name: "Checklist: Create inbound firewall rules" - href: checklist-creating-inbound-firewall-rules.md - - name: "Checklist: Create outbound firewall rules" - href: checklist-creating-outbound-firewall-rules.md - - name: "Checklist: Configure basic firewall settings" - href: checklist-configuring-basic-firewall-settings.md - - name: "Checklist: Configure rules for the isolated domain" - href: checklist-configuring-rules-for-the-isolated-domain.md - - name: "Checklist: Configure rules for the boundary zone" - href: checklist-configuring-rules-for-the-boundary-zone.md - - name: "Checklist: Configure rules for the encryption zone" - href: checklist-configuring-rules-for-the-encryption-zone.md - - name: "Checklist: Configure rules for an isolated server zone" - href: checklist-configuring-rules-for-an-isolated-server-zone.md - - name: "Checklist: Configure rules for servers in a standalone isolated server zone" - href: checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md - - name: "Checklist: Create rules for clients of a standalone isolated server zone" - href: checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md - - name: "Appendix A: Sample GPO template files for settings used in this guide" - href: appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md - - name: Troubleshooting - items: - - name: Troubleshoot UWP app connectivity issues in Windows Firewall - href: troubleshooting-uwp-firewall.md - - name: Filter origin audit log improvements - href: filter-origin-documentation.md - - name: Quarantine behavior - href: quarantine.md - - name: Firewall settings lost on upgrade - href: firewall-settings-lost-on-upgrade.md \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md deleted file mode 100644 index 7bfb1addfd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Add Production Devices to the Membership Group for a Zone -description: Learn how to add production devices to the membership group for a zone and refresh the group policy on the devices in the membership group. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Add Production Devices to the Membership Group for a Zone - -After you test the GPOs for your design on a small set of devices, you can deploy them to the production devices. - -> [!CAUTION] -> For GPOs that contain connection security rules that prevent unauthenticated connections, ensure you set the rules to request, not require, authentication during testing. After you deploy the GPO and confirm that all of your devices are successfully communicating by using authenticated IPsec, then you can modify the GPO to require authentication. Don't change the boundary zone GPO to require mode. - -The method discussed in this guide uses the *Domain Computers* built-in group. The advantage of this method is that all new devices that are joined to the domain automatically receive the isolated domain GPO. To define this setting successfully, you must make sure that the WMI filters and security group filters exclude devices that must not receive the GPOs. Use device groups that deny both read and apply Group Policy permissions to the GPOs, such as a group used in the *CG_DOMISO_NOIPSEC* example design. Devices that are members of some zones must also be excluded from applying the GPOs for the main isolated domain. For more information, see the "Prevent members of a group from applying a GPO" section in [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md). - -Without such a group (or groups), you must either add devices individually or use the groups containing device accounts that are available to you. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. - -In this topic: - -- [Add the group Domain Devices to the GPO membership group](#to-add-domain-devices-to-the-gpo-membership-group) -- [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) - -## To add domain devices to the GPO membership group - -1. Open Active Directory Users and Computers -1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then the container in which you created the membership group -1. In the details pane, double-click the GPO membership group to which you want to add computers -1. Select the **Members** tab, and then click **Add** -1. Type **Domain Computers** in the text box, and then click **OK** -1. Click **OK** to close the group properties dialog box - -After a computer is a member of the group, you can force a Group Policy refresh on the computer. - -## To refresh Group Policy on a device - -From an elevated command prompt, type the following command: - -``` cmd -gpupdate.exe /target:computer /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the computer. - -## To see which GPOs are applied to a device - -From an elevated command prompt, type the following command: - -``` cmd -gpresult.exe /r /scope:computer -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md deleted file mode 100644 index 2ed1c1a950..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Add Test Devices to the Membership Group for a Zone -description: Learn how to add devices to the group for a zone to test whether your Windows Defender Firewall with Advanced Security implementation works as expected. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Add Test Devices to the Membership Group for a Zone - -Before you deploy your rules to large numbers of devices, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between devices. Although we recommend that you set your rules to request mode until testing and deployment is complete. We also recommend that you initially deploy the rules to a few devices only to be sure that the correct GPOs are being processed by each device. - -Add at least one device of each supported operating system type to each membership group. Make sure every GPO for a specific version of Windows and membership group has a device among the test group. After Group Policy has been refreshed on each test device, check the output of the `gpresult.exe` command to confirm that each device is receiving only the GPOs it's supposed to receive. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. - -In this topic: - -- [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-groups) -- [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) - -## To add test devices to the GPO membership groups - -1. Open Active Directory Users and Computers -1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then expand the container that holds your membership group account -1. In the details pane, double-click the GPO membership group to which you want to add devices -1. Select the **Members** tab, and then click **Add** -1. Type the name of the device in the text box, and then click **OK** -1. Repeat steps 5 and 6 for each extra device account or group that you want to add -1. Click **OK** to close the group properties dialog box - -After a device is a member of the group, you can force a Group Policy refresh on the device. - -## To refresh Group Policy on a device - -From an elevated command prompt, run the following command: - -``` cmd -gpupdate /target:device /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the device. - -## To see which GPOs are applied to a device - -From an elevated command prompt, run the following command: - -``` cmd -gpresult /r /scope:computer -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md deleted file mode 100644 index 03fe642a1d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: Appendix A Sample GPO Template Files for Settings Used in this Guide -description: Use sample template files import an XML file containing customized registry preferences into a Group Policy Object (GPO). -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Appendix A: sample GPO template files for settings used in this guide - -You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). - -To manually create the file, build the settings under **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry**. After you create the settings, drag the container to the desktop. An .xml file is created there. - -To import an .xml file to GPMC, drag it and drop it on the **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry** node. If you copy the following sample XML code to a file, and then drag and drop it on the **Registry** node, it creates a **Server and Domain Isolation** collection with the six registry keys discussed in this guide. - -The following sample file uses item-level targeting to ensure that the registry keys are applied only on the versions of Windows to which they apply. - -> [!NOTE] -> The file shown here is for sample use only. It should be customized to meet the requirements of your organization's deployment. To customize this file, import it into a test GPO, modify the settings, and then drag the Server and Domain Isolation Settings node to your desktop. The new file will contain all of your customization. - -```xml - - - - - - - - - - - - - - - - - -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md deleted file mode 100644 index f708e6a031..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Assign Security Group Filters to the GPO -description: Learn how to use Group Policy Management MMC to assign security group filters to a GPO to make sure that the GPO is applied to the correct computers. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Assign Security Group Filters to the GPO - -To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO. - ->[!IMPORTANT] ->This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the relevant GPOs. - -In this topic: - -- [Allow members of a group to apply a GPO](#to-allow-members-of-a-group-to-apply-a-gpo) -- [Prevent members of a group from applying a GPO](#to-prevent-members-of-a-group-from-applying-a-gpo) - -## To allow members of a group to apply a GPO - -Use the following procedure to add a group to the security filter on the GPO that allows group members to apply the GPO. - -1. Open the Group Policy Management console -1. In the navigation pane, find and then select the GPO that you want to modify -1. In the details pane, under **Security Filtering**, select **Authenticated Users**, and then select **Remove** - - >[!NOTE] - >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. - -1. Select **Add** -1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain - -## To prevent members of a group from applying a GPO - -Use the following procedure to add a group to the security filter on the GPO that prevents group members from applying the GPO. This is typically used to prevent members of the boundary and encryption zones from applying the GPOs for the isolated domain. - -1. Open the Group Policy Management console -1. In the navigation pane, find and then select the GPO that you want to modify -1. In the details pane, select the **Delegation** tab -1. Select **Advanced** -1. Under the **Group or user names** list, select **Add** -1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain -1. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy** -1. Select **OK**, and then in the **Windows Security** dialog box, select **Yes** -1. The group appears in the list with **Custom** permissions diff --git a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md deleted file mode 100644 index 748a749676..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Basic Firewall Policy Design -description: Protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses by using basic firewall policy design. -ms.topic: conceptual -ms.date: 11/07/2023 ---- - -# Basic Firewall Policy Design - -Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but don't have a host-based firewall enabled on each device in the organization. - -The Basic Firewall Policy Design helps you to protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses, or that originates from inside your network. In this design, you deploy firewall rules to each device in your organization to allow traffic that is required by the programs that are used. Traffic that doesn't match the rules is dropped. - -Traffic can be blocked or permitted based on the characteristics of each network packet: its source or destination IP address, its source or destination port numbers, the program on the device that receives the inbound packet, and so on. This design can also be deployed together with one or more of the other designs that add IPsec protection to the network traffic permitted. - -Many network administrators don't want to tackle the difficult task of determining all the appropriate rules for every program that is used by the organization, and then maintaining that list over time. In fact, most programs don't require specific firewall rules. The default behavior of Windows and most contemporary applications makes this task easy: - -- On client devices, the default firewall behavior already supports typical client programs. Programs create any required rules for you as part of the installation process. You only have to create a rule if the client program must be able to receive unsolicited inbound network traffic from another device -- When you install a server program that must accept unsolicited inbound network traffic, the installation program likely creates or enables the appropriate rules on the server for you. For example, when you install a server role, the appropriate firewall rules are created and enabled automatically -- For other standard network behavior, the predefined rules that are built into Windows can be configured in a GPO and deployed to the devices in your organization. For example, by using the predefined groups for Core Networking and File and Printer Sharing you can easily configure GPOs with rules for those frequently used networking protocols. - -With a few exceptions, the firewall can be enabled on all configurations. Therefore, we recommend that you enable the firewall on every device in your organization. The term "device" includes servers in your perimeter network, on mobile and remote clients that connect to the network, and on all servers and clients in your internal network. - -> [!CAUTION] -> Stopping the service associated with Windows Defender Firewall with Advanced Security is not supported by Microsoft. - -Windows Defender Firewall with Advanced Security is turned on by default. - -If you turn off the Windows Defender Firewall service you lose other benefits provided by the service, such as the ability to use IPsec connection security rules, Windows Service Hardening, and network protection from forms of attacks that use network fingerprinting. - -Compatible third-party firewall software can programmatically disable only the parts of Windows Defender Firewall that might need to be disabled for compatibility. This approach is the recommended one for third-party firewalls to coexist with the Windows Defender Firewall; third-party firewalls that comply with this recommendation have the certified logo from Microsoft. - -An organization typically uses this design as a first step toward a more comprehensive Windows Defender Firewall design that adds server isolation and domain isolation. - -After implementing this design, you'll have centralized management of the firewall rules applied to all devices that are running Windows in your organization. - -> [!IMPORTANT] -> If you also intend to deploy the [Domain Isolation Policy Design](domain-isolation-policy-design.md), or the [Server Isolation Policy Design](server-isolation-policy-design.md), we recommend that you do the design work for all three designs together, and then deploy in layers that correspond with each design. - -The basic firewall design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the firewall settings and rules. - -For more information about this design: - -- This design coincides with the deployment goal to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) -- To learn more about this design, see [Firewall Policy Design Example](firewall-policy-design-example.md) -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) -- To help you make the decisions required in this design, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -- For a list of detailed tasks that you can use to deploy your basic firewall policy design, see [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) - -> [!div class="nextstepaction"] -> [Domain Isolation Policy Design](domain-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md deleted file mode 100644 index 16684e9cbd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Boundary Zone GPOs -description: Learn about GPOs to create that must align with the group you create for the boundary zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Boundary Zone GPOs - - -All the devices in the boundary zone are added to the group CG\_DOMISO\_Boundary. You must create multiple GPOs to align with this group, one for each operating system that you have in your boundary zone. This group is granted Read and Apply permissions in Group Policy on the GPOs described in this section. - ->**Note:**  If you are designing GPOs for at least Windows Vista or Windows Server 2008, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - -This recommendation means that you create a GPO for a boundary group for a specific operating system by copying and pasting the corresponding GPO for the isolated domain, and then modifying the new copy to provide the behavior required in the boundary zone. - -The boundary zone GPOs discussed in this guide are only for server versions of Windows because client devices aren't expected to participate in the boundary zone. If the need for one occurs, either create a new GPO for that version of Windows or expand the WMI filter attached to one of the existing boundary zone GPOs to make it apply to the client version of Windows. - -In the Woodgrove Bank example, only the GPO settings for a Web service on at least Windows Server 2008 are discussed. - -- [GPO\_DOMISO\_Boundary\_WS2008](gpo-domiso-boundary.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md deleted file mode 100644 index 36a61d385c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Boundary Zone -description: Learn how a boundary zone supports devices that must receive traffic from beyond an isolated domain in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Boundary Zone - - -In most organizations, some devices can receive network traffic from devices that aren't part of the isolated domain, and therefore can't authenticate. To accept communications from untrusted devices, create a boundary zone within your isolated domain. - -Devices in the boundary zone are trusted devices that can accept communication requests both from other isolated domain member devices and from untrusted devices. Boundary zone devices try to authenticate any incoming request by using IPsec, initiating an IKE negotiation with the originating device. - -The GPOs you build for the boundary zone include IPsec or connection security rules that request authentication for both inbound and outbound network connections, but don't require it. - -These boundary zone devices might receive unsolicited inbound communications from untrusted devices that use plaintext and must be carefully managed and secured in other ways. Mitigating this extra risk is an important part of deciding whether to add a device to the boundary zone. For example, completing a formal business justification process before adding each device to the boundary zone minimizes the extra risk. The following illustration shows a sample process that can help make such a decision. - -![design flowchart.](images/wfas-designflowchart1.gif) - -The goal of this process is to determine whether the risk of adding a device to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk can't be mitigated, membership must be denied. - -You must create a group in Active Directory to contain the members of the boundary zones. The settings and rules for the boundary zone are typically similar to those settings and rules for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. The primary difference is that the authentication connection security rule must be set to request authentication for both inbound and outbound traffic, instead of requiring inbound authentication and requesting outbound authentication as used by the isolated domain. - - [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section discusses creation of the group and how to link it to the GPOs that apply the rules to members of the group. - -## GPO settings for boundary zone servers running at least Windows Server 2008 - - -The boundary zone GPO for devices running at least Windows Server 2008 should include the following components: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES, and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members can't use Kerberos V5, you must include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from **Any IP address** to **Any IP address**, that requests inbound and outbound authentication. - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) - -**Next:**[Encryption Zone](encryption-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md deleted file mode 100644 index 8a453cd437..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Certificate-based Isolation Policy Design Example -description: This example uses a fictitious company to illustrate certificate-based isolation policy design in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Certificate-based Isolation Policy Design Example - -This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](firewall-policy-design-example.md), [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). - -One of the servers that must be included in the domain isolation environment is a device running UNIX that supplies other information to the WGBank dashboard program running on the client devices. This device sends updated information to the WGBank front-end servers as it becomes available, so it's considered unsolicited inbound traffic to the devices that receive this information. - -## Design requirements - -One possible solution to this design example is to include an authentication exemption rule in the GPO applied to the WGBank front-end servers. This rule would instruct the front-end servers to accept traffic from the non-Windows device even though it can't authenticate. - -A more secure solution, and the one selected by Woodgrove Bank, is to include the non-Windows device in the domain isolation design. Because it can't join an Active Directory domain, Woodgrove Bank chose to use certificate-based authentication. Certificates are cryptographically protected documents, encrypted in such a way that their origin can be positively confirmed. - -In this case, Woodgrove Bank used Active Directory Certificate Services to create the appropriate certificate. They might also have acquired and installed a certificate from a third-party commercial certification authority. They then used Group Policy to deploy the certificate to the front-end servers. The GPOs applied to the front-end servers also include updated connection security rules that permit certificate-based authentication in addition to Kerberos V5 authentication. They then manually installed the certificate on the UNIX server. - -The UNIX server is configured with firewall and IPsec connection security rules using the tools that are provided by the operating system vendor. Those rules specify that authentication is performed by using the certificate. - -The creation of the IPsec connection security rules for a non-Windows device is beyond the scope of this document, but support for a certificate that can be used to authenticate such a non-Windows device by using the standard IPsec protocols is the subject of this design. - -The non-Windows device can be effectively made a member of the boundary zone or the encryption zone based on the IPsec rules applied to the device. The only constraint is that the main mode and quick mode encryption algorithms supported by the UNIX device must also be supported by the Windows-based devices with which it communicates. - -### Other traffic notes - -- None of the capabilities of the other designs discussed in this guide are compromised by the use of certificate authentication by a non-Windows device. - -## Design details - -Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the devices in their organization. - -The inclusion of one or more non-Windows devices to the network requires only a simple addition to the GPOs for devices that must communicate with the non-Windows device. The addition is allowing certificate-based authentication in addition to the Active Directory-supported Kerberos V5 authentication. This certificate-based authoring doesn't require including new rules, just adding certificate-based authentication as an option to the existing rules. - -When multiple authentication methods are available, two negotiating devices agree on the first one in their lists that match. Because most of the devices in Woodgrove Bank's network run Windows, Kerberos V5 is listed as the first authentication method in the rules. Certificate-based authentication is added as an alternate authentication type. - -With the help of the Active Directory Users and Computers snap-in, Woodgrove Bank created a group named NAG_COMPUTER_WGBUNIX. They then added the device accounts to this group for Windows devices that need to communicate with the non-Windows devices. If all the devices in the isolated domain need to be able to access the non-Windows devices, then the **Domain Computers** group can be added to the group as a member. - -Woodgrove Bank then created a GPO that contains the certificate, and then attached security group filters to the GPO that allow read and apply permissions to only members of the NAG_COMPUTER_WGBUNIX group. The GPO places the certificate in the **Local Computer / Personal / Certificates** certificate store. The certificate used must chain back to a certificate that is in the **Trusted Root Certification Authorities** store on the local device. - -> [!div class="nextstepaction"] -> -> [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md deleted file mode 100644 index f55fd96a04..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Certificate-based Isolation Policy Design -description: Explore the methodology behind Certificate-based Isolation Policy Design and how it defers from Domain Isolation and Server Isolation Policy Design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Certificate-based isolation policy design - -In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Server Isolation Policy Design](server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic. - -Domain isolation and server isolation help provide security for the devices on the network that run Windows and that can be joined to an Active Directory domain. However, in most corporate environments there are typically some devices that must run another operating system. These devices can't join an Active Directory domain, without a third-party package being installed. Also, some devices that do run Windows can't join a domain for various reasons. To rely on Kerberos V5 as the authentication protocol, the device needs to be joined to the Active Directory and (for non-Windows devices) support Kerberos as an authentication protocol. - -To authenticate with non-domain member devices, IPsec supports using standards-based cryptographic certificates. Because this authentication method is also supported by many third-party operating systems, it can be used as a way to extend your isolated domain to devices that don't run Windows. - -The same principles of the domain and server isolation designs apply to this design. Only devices that can authenticate (in this case, by providing a specified certificate) can communicate with the devices in your isolated domain. - -For Windows devices that are part of an Active Directory domain, you can use Group Policy to deploy the certificates required to communicate with the devices that are trusted but aren't part of the Active Directory domain. For other devices, you'll have to either manually configure them with the required certificates, or use a third-party program to distribute the certificates in a secure manner. - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). -- To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). -- To help you make the decisions required in this design, see [Planning Certificate-based Authentication](planning-certificate-based-authentication.md). -- For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md deleted file mode 100644 index cbfaffb255..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Change Rules from Request to Require Mode -description: Learn how to convert a rule from request to require mode and apply the modified GPOs to the client devices. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Change Rules from Request to Require Mode - -After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Don't change the rules for the boundary zone; they must stay in request mode so that devices in the boundary zone can continue to accept connections from devices that aren't part of the isolated domain. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Convert a rule from request to require mode](#to-convert-a-rule-from-request-to-require-mode) -- [Apply the modified GPOs to the client devices](#to-apply-the-modified-gpos-to-the-client-devices) - -## To convert a rule from request to require mode - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -1. In the right navigation pane, click **Connection Security Rules** -1. In the details pane, double-click the connection security rule that you want to modify -1. Click the **Authentication** tab -1. In the **Requirements** section, change **Authenticated mode** to **Require inbound and request outbound**, and then click **OK** - -## To apply the modified GPOs to the client devices - -1. The next time each device refreshes its Group Policy, it will receive the updated GPO and apply the modified rule. To force an immediate refresh, run the following command from an elevated command prompt: - - ``` cmd - gpupdate.exe /force - ``` - -1. To verify that the modified GPO is correctly applied to the client devices, you can run the following command: - - ``` cmd - gpresult.exe /r /scope computer - ``` - -1. Examine the command output for the list of GPOs that are applied to the device, and make sure that the list contains the GPOs you expect to see on that device. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md deleted file mode 100644 index 9b1d50eb96..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Checklist Configuring Basic Firewall Settings -description: Configure Windows Firewall to set inbound and outbound behavior, display notifications, record log files and more of the necessary function for Firewall. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure basic firewall settings - -This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules: - -| Task | Reference | -| - | - | -| Turn the firewall on and set the default inbound and outbound behavior.| [Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)| -| Configure the firewall to not display notifications to the user when a program is blocked, and to ignore locally defined firewall and connection security rules. | [Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) | -| Configure the firewall to record a log file. | [Configure the Windows Defender Firewall with Advanced Security Log](configure-the-windows-firewall-log.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md deleted file mode 100644 index eeacecbac9..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Checklist Configuring Rules for an Isolated Server Zone -description: Use these tasks to configure connection security rules and IPsec settings in GPOs for servers in an isolated server zone that are part of an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for an isolated server zone - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that isn't part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). - -In addition to requiring authentication and optionally encryption, servers in an isolated server zone can be accessed only by users or devices who are authenticated members of a network access group (NAG). If you include user accounts in the NAG, then the restrictions can still apply; they're enforced at the application layer, rather than the IP layer. - -The GPOs for an isolated server or group of servers are similar to those GPOs for the isolated domain itself or the encryption zone, if you require encryption to your isolated servers. This checklist refers you to procedures for creating rules and restrictions that allow only members of the NAG to connect to the server. - -| Task | Reference | -| - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers and they run different versions of the Windows operating system, then start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.
Copy the GPO from the isolated domain or from the encryption zone to serve as a starting point. Where your copy already contains elements listed in the following checklist, review the relevant procedures and compare them to your copied GPO's element to make sure it's constructed in a way that meets the needs of the server isolation zone. |[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| Configure the security group filters and WMI filters on the GPO so that only members of the isolated server zone's membership group that are running the specified version of Windows can read and apply it.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. If you require encryption for the isolated server zone, then make sure that you choose only algorithm combinations that include encryption. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Create a rule that requests authentication for all network traffic.
**Important:** As in an isolated domain, don't set the rules to require authentication for inbound traffic until you have completed testing. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Create the NAG to contain the device or user accounts that are allowed to access the servers in the isolated server zone. | [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| -| Create a firewall rule that permits inbound network traffic only if authenticated as a member of the NAG. | [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test server to the membership group for the isolated server zone. Be sure to add at least one server for each operating system supported by a GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) | - -Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md deleted file mode 100644 index e9eccb33bf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone -description: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for servers in a standalone isolated server zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that isn't part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or devices that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client devices that connect to them. For the GPOs for the client devices, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md). - -The GPOs for isolated servers are similar to those GPOs for an isolated domain. This checklist refers you to those procedures for the creation of some of the rules. The other procedures in this checklist are for creating the restrictions that allow only members of the server access group to connect to the server. - -| Task | Reference | -| - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers running different versions of the Windows operating system, start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the devices for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) | -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. This procedure sets the default settings for the device. If you want to set authentication on a per-rule basis, this procedure is optional.| [Configure Authentication Methods](configure-authentication-methods.md) | -| Create a rule that requests authentication for all inbound network traffic.

**Important:** As in an isolated domain, don't set the rules to require authentication until your testing is complete. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| If your design requires encryption in addition to authentication for access to the isolated servers, then modify the rule to require it. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| -| Create the NAG to contain the device or user accounts that are allowed to access the isolated servers. If you have multiple groups of isolated servers that are accessed by different client devices, then create a NAG for each set of servers.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) | -| Create a firewall rule that allows inbound network traffic only if it's authenticated from a user or device that is a member of the zone's NAG.| [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test server to the membership group for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| - -Don't change the rules for any of your zones to require authentication until all zones have been set up and thoroughly tested. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md deleted file mode 100644 index 2196325d31..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Checklist Configuring Rules for the Boundary Zone -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the boundary zone - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. - -Rules for the boundary zone are typically the same as those rules for the isolated domain, with the exception that the final rule is left to only request, not require, authentication. - -This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). After you create a copy for the boundary zone, make sure that you don't change the rule from request authentication to require authentication when you create the other GPOs. - -| Task | Reference | -| - | - | -| Make a copy of the domain isolation GPO for this version of Windows to serve as a starting point for the GPO for the boundary zone. Unlike the GPO for the main isolated domain zone, this copy isn't changed after deployment to require authentication.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) | -| If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the boundary zone and version of Windows for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the boundary zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security configuration is protecting network traffic with authentication when it can, and that unauthenticated traffic is accepted. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md deleted file mode 100644 index 8916500bda..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Checklist Configuring Rules for the Encryption Zone -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the encryption zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. - -Rules for the encryption zone are typically the same as those rules for the isolated domain, with the exception that the main rule requires encryption in addition to authentication. - -This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). You can then copy those GPOs for use with the encryption zone. After you create the copies, modify the main rule to require encryption in addition to the authentication required by the rest of the isolated domain. - -| Task | Reference | -| - | - | -| Make a copy of the domain isolation GPOs to serve as a starting point for the GPOs for the encryption zone.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| Modify the group memberships and WMI filters so that they're correct for the encryption zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Add the encryption requirements for the zone. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the encryption zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic.| [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md deleted file mode 100644 index 51f6cb3c93..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Checklist Configuring Rules for the Isolated Domain -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the isolated domain - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. - -| Task | Reference | -| - | - | -| Create a GPO for the computers in the isolated domain running one of the operating systems. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you're working on a GPO that was copied from another GPO, modify the group memberships and WMI filters so that they're correct for the isolated domain zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create the rule that requests authentication for all inbound network traffic. | [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the AD DS organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the isolated domain. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic to and from the test computers. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| - -Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md deleted file mode 100644 index c9a715cfbc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Checklist Creating Group Policy Objects -description: Learn to deploy firewall settings, IPsec settings, firewall rules, or connection security rules, by using Group Policy in AD DS. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: Create group policy objects (GPOs) - -To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the end by making GPO assignments as easy as dropping a device into a membership group. - -The checklists for firewall, domain isolation, and server isolation include a link to this checklist. - -## About membership groups - -For most GPO deployment tasks, you must determine which devices must receive and apply which GPOs. Because different versions of Windows can support different settings and rules to achieve similar behavior, you might need multiple GPOs: one for each operating system that has settings different from the others to achieve the same result. Therefore, if your network included those older operating systems you would need to create a GPO for each set of operating systems that can share common settings. To deploy typical domain isolation settings and rules, you might have five different GPOs for the versions of Windows discussed in this guide. By following the procedures in this guide, you only need one membership group to manage all five GPOs. The membership group is identified in the security group filter for all five GPOs. To apply the settings to a device, you make that device's account a member of the membership group. WMI filters are used to ensure that the correct GPO is applied. - -## About exclusion groups - -A Windows Defender Firewall with Advanced Security design must often take into account domain-joined devices on the network that can't or must not apply the rules and settings in the GPOs. Because these devices are typically fewer in number than the devices that must apply the GPO, it's easier to use the Domain Members group in the GPO membership group, and then place these exception devices into an exclusion group that is denied Apply Group Policy permissions on the GPO. Because deny permissions take precedence over allow permissions, a device that is a member of both the membership group and the exception group is prevented from applying the GPO. Devices typically found in a GPO exclusion group for domain isolation include the domain controllers, DHCP servers, and DNS servers. - -You can also use a membership group for one zone as an exclusion group for another zone. For example, devices in the boundary and encryption zones are technically in the main domain isolation zone, but must apply only the GPO for their assigned role. To use the group as an exclusion group, the GPOs for the main isolation zone deny Apply Group Policy permissions to members of the boundary and encryption zones. - -| Task | Reference | -| - | - | -| Review important concepts and examples for deploying GPOs in a way that best meets the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)| -| Create the membership group in AD DS that will be used to contain device accounts that must receive the GPO.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| -| Create a GPO for each version of Windows that has different implementation requirements.| [Create a Group Policy Object](create-a-group-policy-object.md) | -| Create security group filters to limit the GPO to only devices that are members of the membership group and to exclude devices that are members of the exclusion group.|[Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) | -| Create WMI filters to limit each GPO to only the devices that match the criteria in the filter.| [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) | -| If you're working on a GPO that was copied from another, modify the group memberships and WMI filters so that they're correct for the new zone or version of Windows for which this GPO is intended.|[Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) | -| Before adding any rules or configuring the GPO, add a few test devices to the membership group, and make sure that the correct GPO is received and applied to each member of the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md deleted file mode 100644 index 5afd360e1a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Checklist Creating Inbound Firewall Rules -description: Use these tasks for creating inbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: create inbound firewall rules - -This checklist includes tasks for creating firewall rules in your GPOs. - -| Task | Reference | -| - | - | -| Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires. | [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)| -| Create a rule that allows inbound network traffic on a specified port number. | [Create an Inbound Port Rule](create-an-inbound-port-rule.md)| -| Create a rule that allows inbound ICMP network traffic. | [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)| -| Create rules that allow inbound RPC network traffic. | [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md deleted file mode 100644 index d6d1525053..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Checklist Creating Outbound Firewall Rules -description: Use these tasks for creating outbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: create outbound firewall rules - -This checklist includes tasks for creating outbound firewall rules in your GPOs. - -> [!IMPORTANT] -> By default, outbound filtering is disabled. Because all outbound network traffic is permitted, outbound rules are typically used to block traffic that is not wanted on the network. However, it is a best practice for an administrator to create outbound allow rules for those applications that are approved for use on the organization's network. If you do this, then you have the option to set the default outbound behavior to block, preventing any network traffic that is not specifically authorized by the rules you create. - -| Task | Reference | -| - | - | -| Create a rule that allows a program to send any outbound network traffic on any port it requires. | [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)| -| Create a rule that allows outbound network traffic on a specified port number. | [Create an Outbound Port Rule](create-an-outbound-port-rule.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md deleted file mode 100644 index 4d8a44fecc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Create Rules for Standalone Isolated Server Zone Clients -description: Checklist for when creating rules for clients of a Standalone Isolated Server Zone -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: Create rules for clients of a standalone isolated server zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone. - -| Task | Reference | -| - | - | -| Create a GPO for the client devices that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you've finished the tasks in this checklist, you can make a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| To determine which devices receive the GPO, assign the NAG for the isolated servers to the security group filter for the GPO. Make sure that each GPO has the WMI filter for the correct version of Windows.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior has no delay when communicating with devices that can't use IPsec, you can use the same any-to-any rule used in an isolated domain.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test devices to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md deleted file mode 100644 index 3d970485cf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Checklist Implementing a Basic Firewall Policy Design -description: Follow this parent checklist for implementing a basic firewall policy design to ensure successful implementation. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implement a basic firewall policy design - -This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). - -| Task | Reference | -| - | - | -| Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization. | [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Basic Firewall Policy Design](basic-firewall-policy-design.md)
[Firewall Policy Design Example](firewall-policy-design-example.md)
[Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)| -| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 11, Windows 10, and Windows Server 2016, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10 or Windows 11, make a copy of it for Windows Server 2016, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the devices for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)| -| Configure the GPO with firewall default settings appropriate for your design.| [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)| -| Create one or more inbound firewall rules to allow unsolicited inbound network traffic.| [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)| -| Create one or more outbound firewall rules to block unwanted outbound network traffic. | [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add test devices to the membership group, and then confirm that the devices receive the firewall rules from the GPOs as expected.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| According to the testing and roll-out schedule in your design plan, add device accounts to the membership group to deploy the completed firewall policy settings to your devices. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md deleted file mode 100644 index edbfae8e7f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Checklist Implementing a Certificate-based Isolation Policy Design -description: Use these references to learn about using certificates as an authentication option and configure a certificate-based isolation policy design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implement a certificate-based isolation policy design - -This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist - -| Task | Reference | -| - | - | -| Review important concepts and examples for certificate-based authentication to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
[Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
[Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | -| Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you haven't already deployed a CA on your network.| | -| Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| -| Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| -| On a test device, refresh Group Policy and confirm that the certificate is installed. | [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md deleted file mode 100644 index 46079fc693..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Checklist Implementing a Domain Isolation Policy Design -description: Use these references to learn about the domain isolation policy design and links to other checklists to complete tasks require to implement this design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implementing a domain isolation policy design - -This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -The procedures in this section use the Group Policy MMC snap-ins to configure the GPOs, but you can also use Windows PowerShell to configure GPOs. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). - -| Task | Reference | -| - | - | -| Review important concepts and examples for the domain isolation policy design, determine your Windows Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Domain Isolation Policy Design](domain-isolation-policy-design.md)
[Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
[Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | -| Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| -| Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| -| Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| -| Create the GPOs and connection security rules for the isolated server zone.| [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)| -| According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy rules and settings to your computers.| [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| -| After you confirm that network traffic is authenticated by IPsec, you can change authentication rules for the isolated domain and encryption zone from request to require mode.| [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md deleted file mode 100644 index 7596ee7611..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Checklist Implementing a Standalone Server Isolation Policy Design -description: Use these tasks to create a server isolation policy design that isn't part of an isolated domain. See references to concepts and links to other checklists. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implementing a standalone server isolation policy design - -This checklist contains procedures for creating a server isolation policy design that isn't part of an isolated domain. For information on the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md). - -This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -| Task | Reference | -| - | - | -| Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
[Server Isolation Policy Design](server-isolation-policy-design.md)
[Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
[Planning Server Isolation Zones](planning-server-isolation-zones.md) | -| Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| -| Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| -| Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| -| After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it. | [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| -| According to the testing and roll-out schedule in your design plan, add device accounts for the client devices to the membership group so that you can deploy the settings. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md deleted file mode 100644 index 96a9db2d70..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Configure Authentication Methods -description: Learn how to configure authentication methods for devices in an isolated domain or standalone server zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Authentication Methods - - -This procedure shows you how to configure the authentication methods that can be used by computers in an isolated domain or standalone isolated server zone. - ->**Note:**  If you follow the steps in the procedure in this topic, you alter the system-wide default settings. Any connection security rule can use these settings by specifying **Default** on the **Authentication** tab. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure authentication methods** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Authentication Method** section, select the type of authentication that you want to use from among the following: - - 1. **Default**. Selecting this option tells the computer to use the authentication method currently defined by the local administrator in Windows Defender Firewall or by Group Policy as the default. - - 2. **Computer certificate from this certification authority**. Selecting this option and entering the identification of a certification authority (CA) tells the computer to use and require authentication by using a certificate that is issued by the selected CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication extended key usage (EKU) typically provided in a Network Access Protection (NAP) infrastructure can be used for this rule. - - 3. **Advanced**. Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**. - - The first authentication method can be one of the following methods: - - - **Computer (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works only with other computers that can use AuthIP. User-based authentication using Kerberos V5 isn't supported by IKE v1. - - - **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by that CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used. - - - **Preshared key (not recommended)**. Selecting this method and entering a preshared key tells the computer to authenticate by exchanging the preshared keys. If they match, then the authentication succeeds. This method isn't recommended, and is included only for backward compatibility and testing purposes. - - If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - The second authentication method can be one of the following methods: - - - **User (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the currently signed-in user by using their domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other computers that can use AuthIP. User-based authentication using Kerberos V5 isn't supported by IKE v1. - - - **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to specified users or user groups. - - - **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication EKU typically provided in a NAP infrastructure can be used for this rule. - - If you select **Second authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - >**Important:** Make sure that you do not select the check boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails. - -5. Click **OK** on each dialog box to save your changes and return to the Group Policy Management Editor. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md deleted file mode 100644 index a8f2bc0f33..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Configure Data Protection (Quick Mode) Settings -description: Learn how to configure the data protection settings for connection security rules in an isolated domain or a standalone isolated server zone. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Data Protection (Quick Mode) Settings - - -This procedure shows you how to configure the data protection (quick mode) settings for connection security rules in an isolated domain or a standalone isolated server zone. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure quick mode settings** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Data protection (Quick Mode)** section, click **Advanced**, and then click **Customize**. - -5. If you require encryption for all network traffic in the specified zone, then check **Require encryption for all connection security rules that use these settings**. Selecting this option disables the **Data integrity** section, and forces you to select only integrity algorithms that are combined with an encryption algorithm. If you do not select this option, then you can use only data integrity algorithms. Before selecting this option, consider the performance impact and the increase in network traffic that will result. We recommend that you use this setting only on network traffic that truly requires it, such as to and from computers in the encryption zone. - -6. If you did not select **Require encryption**, then select the data integrity algorithms that you want to use to help protect the data sessions between the two computers. If the data integrity algorithms displayed in the list are not what you want, then do the following: - - 1. From the left column, remove any of the data integrity algorithms that you do not want by selecting the algorithm and then clicking **Remove**. - - 2. Add any required data integrity algorithms by clicking **Add**, selecting the appropriate protocol (ESP or AH) and algorithm (SHA1 or MD5), selecting the key lifetime in minutes or sessions, and then clicking **OK**. We recommend that you do not include MD5 in any combination. It is included for backward compatibility only. We also recommend that you use ESP instead of AH if you have any devices on your network that use network address translation (NAT). - - 3. In **Key lifetime (in sessions)**, type the number of times that the quick mode session can be rekeyed. After this number is reached, the quick mode SA must be renegotiated. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent renegotiating of the quick mode SA. We recommend that you use the default value unless your risk analysis indicates the need for a different value. - - 4. Click **OK** to save your algorithm combination settings. - - 5. After the list contains only the combinations you want, use the up and down arrows to the right of the list to rearrange them in the correct order for your design. The algorithm combination that is first in the list is tried first, and so on. - -7. Select the data integrity and encryption algorithms that you want to use to help protect the data sessions between the two computers. If the algorithm combinations displayed in the list are not what you want, then do the following: - - 1. From the second column, remove any of the data integrity and encryption algorithms that you do not want by selecting the algorithm combination and then clicking **Remove**. - - 2. Add any required integrity and encryption algorithm combinations by clicking **Add**, and then doing the following: - - 3. Select the appropriate protocol (ESP or AH). We recommend that you use ESP instead of AH if you have any devices on your network that use NAT. - - 4. Select the appropriate encryption algorithm. The choices include, in order of decreasing security: AES-256, AES-192, AES-128, 3DES, and DES. We recommend that you do not include DES in any combination. It is included for backward compatibility only. - - 5. Select the appropriate integrity algorithm (SHA1 or MD5). We recommend that you do not include MD5 in any combination. It is included for backward compatibility only. - - 6. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operations between the two computers that negotiated this key will require a new key. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent rekeying. We recommend that you use the default value unless your risk analysis indicates the need for a different value. - -8. Click **OK** three times to save your settings. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md deleted file mode 100644 index f049b2e663..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Configure Group Policy to Autoenroll and Deploy Certificates -description: Learn how to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Group Policy to Autoenroll and Deploy Certificates - - -You can use this procedure to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. Follow this procedure for each GPO that contains IPsec connection security rules that require this certificate. - -**Administrative credentials** - -To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest and a member of the Enterprise Admins group. - -**To configure Group Policy to autoenroll certificates** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane, expand the following path: **Computer Configuration**, **Policies**, **Windows Settings**, **Security Settings**, **Public Key Policies**. - -4. Double-click **Certificate Services Client - Auto-Enrollment**. - -5. In the **Properties** dialog box, change **Configuration Model** to **Enabled**. - -6. Select both **Renew expired certificates, update pending certificates, and remove revoked certificates** and **Update certificates that use certificate templates**. - -7. Click **OK** to save your changes. Computers apply the GPO and download the certificate the next time Group Policy is refreshed. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md deleted file mode 100644 index 02ffc24817..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Configure Key Exchange (Main Mode) Settings -description: Learn how to configure the main mode key exchange settings used to secure the IPsec authentication traffic in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Key Exchange (Main Mode) Settings - - -This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure key exchange settings** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Key exchange (Main Mode)** section, click **Advanced**, and then click **Customize**. - -5. Select the security methods to be used to help protect the main mode negotiations between the two devices. If the security methods displayed in the list aren't what you want, then do the following steps: - - **Important**   - In Windows Vista, Windows Server 2008, or later, you can specify only one key exchange algorithm. This rule means that if you want to communicate by using IPsec with another device running Windows 8 or Windows Server 2012, then you must select the same key exchange algorithm on both devices. - - Also, if you create a connection security rule that specifies an option that requires AuthIP instead of IKE, then only the one combination of the top integrity and encryption security method is used in the negotiation. Ensure that all of your devices that are running at least Windows Vista and Windows Server 2008 have the same methods at the top of the list and the same key exchange algorithm selected. - - **Note**   - When AuthIP is used, no Diffie-Hellman key exchange protocol is used. Instead, when Kerberos V5 authentication is requested, the Kerberos V5 service ticket secret is used in place of a Diffie-Hellman value. When either certificate authentication or NTLM authentication is requested, a transport level security (TLS) session is established, and its secret is used in place of the Diffie-Hellman value. This event happens no matter which Diffie-Hellman key exchange protocol you select. - - 1. Remove any of the security methods that you don't want by selecting the method and then clicking **Remove**. - - 2. Add any required security method combinations by clicking **Add**, selecting the appropriate encryption algorithm and integrity algorithm from the lists, and then clicking **OK**. - - >**Caution:**  We recommend that you do not include MD5 or DES in any combination. They are included for backward compatibility only. - - 3. After the list contains only the combinations you want, use the "up" and "down" arrows to the right of the list to arrange them in the order of preference. The combination that appears first in the list is tried first, and so on. - -6. From the list on the right, select the key exchange algorithm that you want to use. - - >**Caution:**  We recommend that you do not use Diffie-Hellman Group 1. It is included for backward compatibility only.  - -7. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operation between the two devices requires a new key. - - >**Note:**  You need to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance. - -8. In **Key lifetime (in sessions)**, type the number of sessions. After the specified number of quick mode sessions have been created within the security association protected by this key, IPsec requires a new key. - -9. Click **OK** three times to save your settings. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md deleted file mode 100644 index ce9b0f15ce..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Configure the Rules to Require Encryption -description: Learn how to configure rules to add encryption algorithms and delete the algorithm combinations that don't use encryption for zones that require encryption. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure the Rules to Require Encryption - -If you're creating a zone that requires encryption, you must configure the rules to add the encryption algorithms and delete the algorithm combinations that don't use encryption. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To modify an authentication request rule to also require encryption** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Connection Security Rules**. - -3. In the details pane, double-click the connection security rule you want to modify. - -4. On the **Name** page, rename the connection security rule, edit the description to reflect the new use for the rule, and then click **OK**. - -5. In the navigation pane, right-click **Windows Defender Firewall – LDAP://CN={**guid**}**, and then click **Properties**. - -6. Click the **IPsec Settings** tab. - -7. Under **IPsec defaults**, click **Customize**. - -8. Under **Data protection (Quick Mode)**, click **Advanced**, and then click **Customize**. - -9. Click **Require encryption for all connection security rules that use these settings**. - - This setting disables the data integrity rules section. Ensure the **Data integrity and encryption** list contains all of the combinations that your client devices will use to connect to members of the encryption zone. The client devices receive their rules through the GPO for the zone to which they reside. You must make sure that those rules contain at least one of the data integrity and encryption algorithms that are configured in this rule, or the client devices in that zone won't be able to connect to devices in this zone. - -10. If you need to add an algorithm combination, click **Add** and then select the combination of encryption and integrity algorithms. The options are described in [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md). - - **Note**   - Not all of the algorithms available in Windows 8 or Windows Server 2012 and later can be selected in the Windows Defender Firewall with Advanced Security user interface. To select them, you can use Windows PowerShell. - - Quick mode settings can also be configured on a per-rule basis, but not by using the Windows Defender Firewall user interface. Instead, you can create or modify the rules by using Windows PowerShell. - - For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) - -11. During negotiation, algorithm combinations are proposed in the order shown in the list. Ensure that the more secure combinations are at the top of the list so that the negotiating devices select the most secure combination that they can jointly support. - -12. Click **OK** three times to save your changes. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md deleted file mode 100644 index fe9d417849..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure the Workstation Authentication Template -description: Learn how to configure a workstation authentication certificate template, which is used for device certificates that are enrolled and deployed to workstations. -ms.prod: windows-client -ms.date: 09/07/2021 -ms.topic: conceptual ---- - -# Configure the Workstation Authentication Certificate Template - - -This procedure describes how to configure a certificate template that Active Directory Certification Services (AD CS) uses as the starting point for device certificates that are automatically enrolled and deployed to workstations in the domain. It shows how to create a copy of a template, and then configure the template according to your design requirements. - -**Administrative credentials** - -## To configure the workstation authentication certificate template and autoenrollment -To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest, and a member of the Enterprise Admins group. - - -1. On the device where AD CS is installed, open the Certification Authority console. - -2. In the navigation pane, right-click **Certificate Templates**, and then click **Manage**. - -3. In the details pane, click the **Workstation Authentication** template. - -4. On the **Action** menu, click **Duplicate Template**. In the **Duplicate Template** dialog box, select the template version that is appropriate for your deployment, and then click **OK**. For the resulting certificates to have maximum compatibility with the available versions of Windows, we recommended that you select **Windows Server 2003**. - -5. On the **General** tab, in **Template display name**, type a new name for the certificate template, such as **Domain Isolation Workstation Authentication Template**. - -6. Click the **Subject Name** tab. Make sure that **Build from this Active Directory information** is selected. In **Subject name format**, select **Fully distinguished name**. - -7. Click the **Cryptography** tab. You must determine the best minimum key size for your environment. Large key sizes provide better security, but they can affect server performance. We recommended that you use the default setting of 2048. - -8. Click the **Security** tab. In **Group or user names**, click **Domain Computers**, under **Allow**, select **Enroll** and **Autoenroll**, and then click **OK**. - - >**Note:**  If you want do not want to deploy the certificate to every device in the domain, then specify a different group or groups that contain the device accounts that you want to receive the certificate. - -9. Close the Certificate Templates Console. - -10. In the Certification Authority MMC snap-in, in the left pane, right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - -11. In the **Enable Certificate Templates** dialog box, click the name of the certificate template you configured, and then click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md deleted file mode 100644 index fe75296fec..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program is Blocked -description: Configure Windows Defender Firewall with Advanced Security to suppress notifications when a program is Blocked -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked - - -To configure Windows Defender Firewall with Advanced Security to suppress the display of a notification when it blocks a program that tries to listen for network traffic and to prohibit locally defined rules, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. - ->**Caution:**  If you choose to disable alerts and prohibit locally defined rules, then you must create firewall rules that allow your users’ programs to send and receive the required network traffic. If a firewall rule is missing, then the user does not receive any kind of warning, the network traffic is silently blocked, and the program might fail. - -We recommend that you don't enable these settings until you've created and tested the required rules. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To configure Windows Defender Firewall to suppress the display of a notification for a blocked program and to ignore locally defined rules - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. - -3. For each network location type (Domain, Private, Public), perform the following steps. - - 1. Click the tab that corresponds to the network location type. - - 2. Under **Settings**, click **Customize**. - - 3. Under **Firewall settings**, change **Display a notification** to **No**. - - 4. Under **Rule merging**, change **Apply local firewall rules** to **No**. - - 5. Although a connection security rule isn't a firewall setting, you can also use this tab to prohibit locally defined connection security rules if you're planning to deploy IPsec rules as part of a server or domain isolation environment. Under **Rule merging**, change **Apply local connection security rules** to **No**. - - 6. Click **OK** twice. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md b/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md deleted file mode 100644 index dcca043129..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Confirm That Certificates Are Deployed Correctly -description: Learn how to confirm that a Group Policy is being applied as expected and that the certificates are being properly installed on the workstations. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 01/24/2023 ---- - -# Confirm That Certificates Are Deployed Correctly - -After configuring your certificates and autoenrollment in Group Policy, you can confirm that the policy is being applied as expected, and that the certificates are being properly installed on the workstation devices. - -In these procedures, you refresh Group Policy on a client device, and then confirm that the certificate is deployed correctly. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Refresh Group Policy on a device](#to-refresh-group-policy-on-a-device) -- [Verify that a certificate is installed](#to-verify-that-a-certificate-is-installed) - -## To refresh Group Policy on a device - - From an elevated command prompt, run the following command: - -``` cmd -gpupdate /target:computer /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the device. - -## To verify that a certificate is installed - -1. Open the Certificates console -1. In the navigation pane, expand **Trusted Root Certification Authorities**, and then click **Certificates** - - The CA that you created appears in the list. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md deleted file mode 100644 index 2493780e6b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Copy a GPO to Create a New GPO -description: Learn how to make a copy of a GPO by using the Active Directory Users and devices MMC snap-in to create a GPO for boundary zone devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Copy a GPO to Create a New GPO - - -To create the GPO for the boundary zone devices, make a copy of the main domain isolation GPO, and then change the settings to request, instead of require, authentication. To make a copy of a GPO, use the Active Directory Users and devices MMC snap-in. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs. - -**To make a copy of a GPO** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:**YourForestName, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**. - -3. In the details pane, right-click the GPO you want to copy, and then click **Copy**. - -4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. - - :::image type="content" alt-text="Screenshot that shows Copy Paste GPO." source="images/grouppolicy-paste.png"::: - -5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. - -6. After the copy is complete, click **OK**. The new GPO is named **Copy of** *original GPO name*. - -7. To rename it, right-click the GPO, and then click **Rename**. - -8. Type the new name, and then press ENTER. - -9. You must change the security filters to apply the policy to the correct group of devices. To change the security filters, click the **Scope** tab, and in the **Security Filtering** section, select the group that grants permissions to all members of the isolated domain, for example **CG\_DOMISO\_IsolatedDomain**, and then click **Remove**. - -10. In the confirmation dialog box, click **OK**. - -11. Click **Add**. - -12. Type the name of the group that contains members of the boundary zone, for example **CG\_DOMISO\_Boundary**, and then click **OK**. - -13. If necessary, change the WMI filter to one appropriate for the new GPO. For example, if the original GPO is for client devices running Windows 10 or Windows 11, and the new boundary zone GPO is for devices running Windows Server 2016, then select a WMI filter that allows only those devices to read and apply the GPO. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md deleted file mode 100644 index e323d44596..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Create a Group Account in Active Directory -description: Learn how to create a security group for the computers that are to receive Group Policy settings by using the Active Directory Users and Computers console. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create a Group Account in Active Directory - - -To create a security group to contain the computer accounts for the computers that are to receive a set of Group Policy settings, use the Active Directory Users and Computers console. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new group accounts. - -**To add a new membership group in Active Directory** - -1. Open the Active Directory Users and Computers console. - -2. In the navigation pane, select the container in which you want to store your group. This is typically the **Users** container under the domain. - -3. Click **Action**, click **New**, and then click **Group**. - -4. In the **Group name** text box, type the name for your new group. - - >**Note:**  Be sure to use a name that clearly indicates its purpose. Check to see if your organization has a naming convention for groups. - -5. In the **Description** text box, enter a description of the purpose of this group. - -6. In the **Group scope** section, select either **Global** or **Universal**, depending on your Active Directory forest structure. If your group must include computers from multiple domains, then select **Universal**. If all of the members are from the same domain, then select **Global**. - -7. In the **Group type** section, click **Security**. - -8. Click **OK** to save your group. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md deleted file mode 100644 index 11638e864b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Create a Group Policy Object -description: Learn how to use the Active Directory Users and Computers MMC snap-in to create a GPO. You must be a member of the Domain Administrators group. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create a Group Policy Object - - -To create a new GPO, use the Active Directory Users and Computers MMC snap-in. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs. - -To create a new GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:**YourForestName, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**. - -3. Click **Action**, and then click **New**. - -4. In the **Name** text box, type the name for your new GPO. - - > [!NOTE] - > Be sure to use a name that clearly indicates the purpose of the GPO. Check to see if your organization has a naming convention for GPOs. - -5. Leave **Source Starter GPO** set to **(none)**, and then click **OK**. - -6. If your GPO will not contain any user settings, then you can improve performance by disabling the **User Configuration** section of the GPO. To do this, perform these steps: - - 1. In the navigation pane, click the new GPO. - - 2. In the details pane, click the **Details** tab. - - 3. Change the **GPO Status** to **User configuration settings disabled**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md deleted file mode 100644 index 76f020233e..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Create an Authentication Exemption List Rule -description: Learn how to create rules that exempt devices that cannot communicate by using IPSec from the authentication requirements of your isolation policies. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Authentication Exemption List Rule - - -In almost any isolated server or isolated domain scenario, there are some devices or devices that cannot communicate by using IPsec. This procedure shows you how to create rules that exempt those devices from the authentication requirements of your isolation policies. - -**Important**   -Adding devices to the exemption list for a zone reduces security because it permits devices in the zone to send network traffic that is unprotected by IPsec to the devices on the list. As discussed in the Windows Defender Firewall with Advanced Security Design Guide, you must add only managed and trusted devices to the exemption list. - - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To create a rule that exempts specified hosts from authentication** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Connection Security Rules**. - -3. Click **Action**, and then click **New Rule**. - -4. On the **Rule Type** page of the New Connection Security Rule Wizard, click **Authentication exemption**, and then click **Next**. - -5. On the **Exempt Computers** page, to create a new exemption, click **Add**. To modify an existing exemption, click it, and then click **Edit**. - -6. In the **IP Address** dialog box, do one of the following: - - - To add a single IP address, click **This IP address or subnet**, type the IP address of the host in the text box, and then click **OK**. - - - To add an entire subnet by address, click **This IP address or subnet**, and then type the IP address of the subnet, followed by a forward slash (/) and the number of bits in the corresponding subnet mask. For example, **10.50.0.0/16** represents the class B subnet that begins with address 10.50.0.1, and ends with address **10.50.255.254**. Click **OK** when you are finished. - - - To add the local device’s subnet, click **Predefined set of computers**, select **Local subnet** from the list, and then click **OK**. - - >**Note:**  If you select the local subnet from the list rather than typing the subnet address in manually, the device automatically adjusts the active local subnet to match the device’s current IP address. - - - To add a discrete range of addresses that do not correspond to a subnet, click **This IP address range**, type the beginning and ending IP addresses in the **From** and **To** text boxes, and then click **OK**. - - - To exempt all of the remote hosts that the local device uses for a specified network service, click **Predefined set of computers**, select the network service from the list, and then click **OK**. - -7. Repeat steps 5 and 6 for each exemption that you need to create. - -8. Click **Next** when you have created all of the exemptions. - -9. On the **Profile** page, check the profile for each network location type to which this set of exemptions applies, and then click **Next**. - - >**Caution:**  If all of the exemptions are on the organization’s network and that network is managed by an Active Directory domain, then consider restricting the rule to the Domain profile only. Selecting the wrong profile can reduce the protection for your computer because any computer with an IP address that matches an exemption rule will not be required to authenticate. - -10. On the **Name** page, type the name of the exemption rule, type a description, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md deleted file mode 100644 index 488578107f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Create an Authentication Request Rule -description: Create a new rule for Windows Defender Firewall with Advanced Security so devices on the network use IPsec protocols and methods before they can communicate. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Authentication Request Rule - -**Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - -After you have configured IPsec algorithms and authentication methods, you can create the rule that requires the devices on the network to use those protocols and methods before they can communicate. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the (Group Policy Objects) GPOs. - -To create the authentication request rule: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, right-click **Connection Security Rules**, and then click **New Rule**. - -3. On the **Rule Type** page, select **Isolation**, and then click **Next**. - -4. On the **Requirements** page, select **Request authentication for inbound and outbound connections**. - - > [!CAUTION] - > Do not configure the rule to require inbound authentication until you have confirmed that all of your devices are receiving the correct GPOs, and are successfully negotiating IPsec and authenticating with each other. Allowing the devices to communicate even when authentication fails prevents any errors in the GPOs or their distribution from breaking communications on your network. - -5. On the **Authentication Method** page, select the authentication option you want to use on your network. To select multiple methods that are attempted in order until one succeeds, click **Advanced**, click **Customize**, and then click **Add** to add methods to the list. Second authentication methods require Authenticated IP (AuthIP). - - 1. **Default**. Selecting this option tells the device to request authentication by using the method currently defined as the default on the device. This default might have been configured when the operating system was installed or it might have been configured by Group Policy. Selecting this option is appropriate when you have configured system-wide settings by using the [Configure Authentication Methods](configure-authentication-methods.md) procedure. - - 2. **Advanced**. Selecting this option enables you to specify a custom combination of authentication methods required for your scenario. - -6. Optional: If you selected **Advanced** in the previous step, then Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**. - - The **First authentication method** can be one of the following: - - - **Computer (NTLMv2)**. Selecting this option tells the device to use and require authentication of the device by using its domain credentials. This option works only with other devices that can use AuthIP. User-based authentication using Kerberos V5 is not supported by IKE v1. - - - **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to request authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule. - - - **Preshared key (not recommended)**. Selecting this method and entering a pre-shared key tells the device to authenticate by exchanging the pre-shared keys. If the keys match, then the authentication succeeds. This method is not recommended, and is included for backward compatibility and testing purposes only. - - If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - The **Second authentication method** can be one of the following: - - - **User (NTLMv2)**. Selecting this option tells the device to use and require authentication of the currently logged-on user by using his or her domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other devices that can use AuthIP. User-based authentication using NTLMv2 is not supported by IKE v1. - - - **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to request user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to certain users or user groups. - - - **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule. - - If you check **Second authentication is optional**, the connection can succeed even if the authentication attempt specified in this column fails. - - > [!IMPORTANT] - > Make sure that you do not select the boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails. - -7. After you have configured the authentication methods, click **OK** on each dialog box to save your changes and close it, until you return to the **Authentication Method** page in the wizard. Click **Next**. - -8. On the **Profile** page, select the check boxes for the network location type profiles to which this rule applies. - - - On portable devices, consider clearing the **Private** and **Public** boxes to enable the device to communicate without authentication when it is away from the domain network. - - - On devices that do not move from network to network, consider selecting all the profiles. Doing so prevents an unexpected switch in the network location type from disabling the rule. - - Click **Next**. - -9. On the **Name** page, type a name for the connection security rule and a description, and then click **Finish**. - - The new rule appears in the list of connection security rules. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md deleted file mode 100644 index a2cad4e58d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Create WMI Filters for the GPO -description: Learn how to use WMI filters on a GPO to make sure that each GPO for a group can only be applied to devices running the correct version of Windows. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create WMI Filters for the GPO - - -To make sure that each GPO associated with a group can only be applied to devices running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each device. - -- [Create WMI Filters for the GPO](#create-wmi-filters-for-the-gpo) - - [To create a WMI filter that queries for a specified version of Windows](#to-create-a-wmi-filter-that-queries-for-a-specified-version-of-windows) - - [To link a WMI filter to a GPO](#to-link-a-wmi-filter-to-a-gpo) - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -First, create the WMI filter and configure it to look for a specified version (or versions) of the Windows operating system. - -## To create a WMI filter that queries for a specified version of Windows - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, and then select **WMI Filters**. - -3. Select **Action**, and then select **New**. - -4. In the **Name** text box, type the name of the WMI filter. Be sure to use a name that clearly indicates the purpose of the filter. Check to see if your organization has a naming convention. - -5. In the **Description** text box, type a description for the WMI filter. For example, if the filter excludes domain controllers, you might consider stating that in the description. - -6. Select **Add**. - -7. Leave the **Namespace** value set to **root\\CIMv2**. - -8. In the **Query** text box, type: - - ``` syntax - select * from Win32_OperatingSystem where Version like "6.%" - ``` - - This query will return **true** for devices running at least Windows Vista and Windows Server 2008. To set a filter for just Windows 8 and Windows Server 2012, use "6.2%". For Windows 11, Windows 10, and Windows Server 2016, use "10.%". To specify multiple versions, combine them with or, as shown in the following: - - ``` syntax - ... where Version like "6.1%" or Version like "6.2%" - ``` - - To restrict the query to only clients or only servers, add a clause that includes the ProductType parameter. To filter for client operating systems only, such as Windows 8 or Windows 7, use only ProductType="1". For server operating systems that are not domain controllers and for Windows 10 and Windows 11 multi-session, use ProductType="3". For domain controllers only, use ProductType="2". This is a useful distinction, because you often want to prevent your GPOs from being applied to the domain controllers on your network. - - The following clause returns **true** for all devices that are not domain controllers: - - ``` syntax - ... where ProductType="1" or ProductType="3" - ``` - - The following complete query returns **true** for all devices running Windows 10 and Windows 11, and returns **false** for any server operating system or any other client operating system. - - ``` syntax - select * from Win32_OperatingSystem where Version like "10.%" and ProductType="1" - ``` - - Specific versions of Windows 10 can be targeted by including the *major build version* in the query. The following query returns **true** for all devices running Windows 10 20H2 (which has a *major build version* of `19042`), and returns **false** for any server operating system or any other client operating system. Additional information about Windows 10 build versions can be found at [Windows 10 release information](/windows/release-health/release-information). - - ```syntax - select * from Win32_OperatingSystem where Version like "10.0.19042" and ProductType="1" - ``` - - The following query returns **true** for any device running Windows Server 2016, except domain controllers: - - ``` syntax - select * from Win32_OperatingSystem where Version like "10.%" and ProductType="3" - ``` - -9. Select **OK** to save the query to the filter. - -10. Select **Save** to save your completed filter. - -> [!NOTE] -> If you're using multiple queries in the same WMI filter, these queries must all return **TRUE** for the filter requirements to be met and for the GPO to be applied. - -## To link a WMI filter to a GPO - -After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs. - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then select the GPO that you want to modify. - -3. Under **WMI Filtering**, select the correct WMI filter from the list. - -4. Select **Yes** to accept the filter. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md deleted file mode 100644 index 62d1fcb8d8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Determining the Trusted State of Your Devices -description: Learn how to define the trusted state of devices in your enterprise to help design your strategy for using Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Determining the Trusted State of Your Devices - - -After obtaining information about the devices that are currently part of the IT infrastructure, you must determine at what point a device is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this communication can lead to problems with the security of the trusted environment, because the overall security can't exceed the level of security set by the least secure client that achieves trusted status. - ->**Note:**  In this context, the term *trust* has nothing to do with an Active Directory trust relationship between domains. The trusted state of your devices just indicates the level of risk that you believe the device brings to the network. Trusted devices bring little risk whereas untrusted devices can potentially bring great risk. - -## Trust states - - -To understand this concept, consider the four basic states that apply to devices in a typical IT infrastructure. These states are (in order of risk, lowest risk first): - -- Trusted - -- Trustworthy - -- Known, untrusted - -- Unknown, untrusted - -The remainder of this section defines these states and how to determine which devices in your organization belong in each state. - -### Trusted state - -Classifying a device as trusted means that the device's security risks are managed, but it doesn't imply that it's perfectly secure or invulnerable. The responsibility for this managed state falls to the IT and security administrators, in addition to the users who are responsible for the configuration of the device. A trusted device that is poorly managed will likely become a point of weakness for the network. - -When a device is considered trusted, other trusted devices can reasonably assume that the device won't initiate a malicious act. For example, trusted devices can expect that other trusted devices won't run a virus that attacks them, because all trusted devices are required to use mechanisms (such as antivirus software) to mitigate the threat of viruses. - -Spend some time defining the goals and technology requirements that your organization considers appropriate as the minimum configuration for a device to obtain trusted status. - -A possible list of technology requirements might include: - -- **Operating system.** A trusted client device should run at least Windows Vista. A trusted server should run at least Windows Server 2008. - -- **Domain membership.** A trusted device will belong to a managed Active Directory domain, which means that the IT department has security management rights and can configure member devices by using Group Policy. - -- **Management client.** All trusted devices must run a specific network management client to allow for centralized management and control of security policies, configurations, and software. Configuration Manager is one such management system with an appropriate client. - -- **Antivirus software.** All trusted devices will run antivirus software that is configured to check for and automatically update the latest virus signature files daily. - -- **File system.** All trusted devices will be configured to use the NTFS file system. - -- **BIOS settings.** All trusted portable devices will be configured to use a BIOS-level password that is under the management of the IT support team. - -- **Password requirements.** Trusted clients must use strong passwords. - -It's important to understand that the trusted state isn't constant; it's a transient state that is subject to changing security standards and compliance with those standards. New threats and new defenses emerge constantly. For this reason, the organization's management systems must continually check the trusted devices to ensure ongoing compliance. Additionally, the management systems must be able to issue updates or configuration changes if they're required to help maintain the trusted status. - -A device that continues to meet all these security requirements can be considered trusted. However it's possible that most devices that were identified in the discovery process discussed earlier don't meet these requirements. Therefore, you must identify which devices can be trusted and which ones can't. To help with this process, you use the intermediate *trustworthy* state. The remainder of this section discusses the different states and their implications. - -### Trustworthy state - -It's useful to identify as soon as possible those devices in your current infrastructure that can achieve a trusted state. A *trustworthy state* can be assigned to indicate that the current device can physically achieve the trusted state with required software and configuration changes. - -For each device that is assigned a trustworthy status, make an accompanying configuration note that states what is required to enable the device to achieve trusted status. This information is especially important to both the project design team (to estimate the costs of adding the device to the solution) and the support staff (to enable them to apply the required configuration). - -Generally, trustworthy devices fall into one of the following two groups: - -- **Configuration required.** The current hardware, operating system, and software enable the device to achieve a trustworthy state. However, more configuration changes are required. For example, if the organization requires a secure file system before a device can be considered trusted, a device that uses a FAT32-formatted hard disk doesn't meet this requirement. - -- **Upgrade required.** These devices require upgrades before they can be considered trusted. The following list provides some examples of the type of upgrade these devices might require: - - - **Operating system upgrade required.** If the device's current operating system can't support the security needs of the organization, an upgrade would be required before the device could achieve a trusted state. - - - **Software required.** A device that is missing a required security application, such as an antivirus scanner or a management client, can't be considered trusted until these applications are installed and active. - - - **Hardware upgrade required.** In some cases, a device might require a specific hardware upgrade before it can achieve trusted status. This type of device usually needs an operating system upgrade or another software that forces the required hardware upgrade. For example, security software might require more hard disk space on the device. - - - **Device replacement required.** This category is reserved for devices that can't support the security requirements of the solution because their hardware can't support the minimum acceptable configuration. For example, a device that can't run a secure operating system because it has an old processor (such as a 100 megahertz \[MHz\] x86-based device). - -Use these groups to assign costs for implementing the solution on the devices that require upgrades. - -### Known, untrusted state - -During the process of categorizing an organization's devices, you'll identify some devices that can't achieve trusted status for specific well-understood and well-defined reasons. These reasons might include the following types: - -- **Financial.** The funding isn't available to upgrade the hardware or software for this device. - -- **Political.** The device must remain in an untrusted state because of a political or business situation that doesn't enable it to comply with the stated minimum security requirements of the organization. It's highly recommended that you contact the business owner or independent software vendor (ISV) for the device to discuss the added value of server and domain isolation. - -- **Functional.** The device must run a nonsecure operating system or must operate in a nonsecure manner to perform its role. For example, the device might be required to run an older operating system because a specific line of business application will only work on that operating system. - -There can be multiple functional reasons for a device to remain in the known untrusted state. The following list includes several examples of functional reasons that can lead to a classification of this state: - -- **Devices that run unsupported versions of Windows.** These versions include Windows XP, Windows Millennium Edition, Windows 98, Windows 95, or Windows NT. Devices that run these versions of the Windows operating system can't be classified as trustworthy because these operating systems don't support the required security infrastructure. For example, although Windows NT does support a basic security infrastructure, it doesn't support “deny” ACLs on local resources, any way to ensure the confidentiality and integrity of network communications, smart cards for strong authentication, or centralized management of device configurations (although limited central management of user configurations is supported). - -- **Stand-alone devices.** Devices running any version of Windows which are configured as stand-alone devices or as members of a workgroup usually can't achieve a trustworthy state. Although these devices fully support the minimum required basic security infrastructure, the required security management capabilities are unlikely to be available when the device isn't a part of a trusted domain. - -- **Devices in an untrusted domain.** A device that is a member of a domain that isn't trusted by an organization's IT department can't be classified as trusted. An untrusted domain is a domain that can't provide the required security capabilities to its members. Although the operating systems of devices that are members of this untrusted domain might fully support the minimum required basic security infrastructure, the required security management capabilities can't be fully guaranteed when devices aren't in a trusted domain. - -### Unknown, untrusted state - -The unknown, untrusted state should be considered the default state for all devices. Because devices in this state have a configuration that is unknown, you can assign no trust to them. All planning for devices in this state must assume that the device is an unacceptable risk to the organization. Designers of the solution should strive to minimize the impact that the devices in this state can have on their organizations. - -## Capturing upgrade costs for current devices - - -The final step in this part of the process is to record the approximate cost of upgrading the devices to a point that they can participate in the server and domain isolation design. You must make several key decisions during the design phase of the project that require answers to the following questions: - -- Does the device meet the minimum hardware requirements necessary for isolation? - -- Does the device meet the minimum software requirements necessary for isolation? - -- What configuration changes must be made to integrate this device into the isolation solution? - -- What is the projected cost or impact of making the proposed changes to enable the device to achieve a trusted state? - -By answering these questions, you can quickly determine the level of effort and approximate cost of bringing a particular device or group of devices into the scope of the project. It's important to remember that the state of a device is transitive, and that by performing the listed remedial actions you can change the state of a device from untrusted to trusted. After you decide whether to place a device in a trusted state, you're ready to begin planning and designing the isolation groups, which the next section [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) discusses. - -The following table is an example of a data sheet that you could use to help capture the current state of a device and what would be required for the device to achieve a trusted state. - -| Device name | Hardware reqs met | Software reqs met | Configuration required | Details | Projected cost | -| - | - | - | - | - | - | -| CLIENT001 | No| No| Upgrade hardware and software.| Current operating system is Windows XP. Old hardware isn't compatible with newer versions of Windows.| $??| -| SERVER001 | Yes| No| Join trusted domain and upgrade from Windows Server 2003 to Windows Server 2012.| No antivirus software present.| $??| - -In the previous table, the device CLIENT001 is currently "known, untrusted" because its hardware must be upgraded. However, it could be considered trustworthy if the required upgrades are possible. However, if many devices require the same upgrades, the overall cost of the solution would be much higher. - -The device SERVER001 is "trustworthy" because it meets the hardware requirements but its operating system must be upgraded. It also requires antivirus software. The projected cost is the amount of effort that is required to upgrade the operating system and install antivirus software, along with their purchase costs. - -With the other information that you've gathered in this section, this information will be the foundation of the efforts performed later in the [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) section. - -The costs identified in this section only capture the projected cost of the device upgrades. Many more design, support, test, and training costs should be accounted for in the overall project plan. - -**Next:** [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md deleted file mode 100644 index 16cb030c90..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Documenting the Zones -description: Learn how to document the zone placement of devices in your design for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Documenting the Zones - - -Generally, the task of determining zone membership isn't complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Defender Firewall with Advanced Security Strategy section. A sample is shown here: - -| Host name | Hardware reqs met | Software reqs met | Configuration required | Details | Projected cost | Group | -| - | - | - | - | - | - | -| CLIENT001 | No| No| Upgrade hardware and software.| Current operating system is Windows XP. Old hardware not compatible with newer versions of Windows.| $??| Isolated domain| -| SERVER002 | Yes| No| Join trusted domain, upgrade from Windows Server 2008 to at least Windows Server 2012| No antivirus software present.| $??| Encryption| -| SENSITIVE001 | Yes| Yes| Not required.| Running Windows Server 2012. Ready for inclusion.| $0| Isolated server (in zone by itself)| -| PRINTSVR1 | Yes| Yes| Not required.| Running Windows Server 2008 R2. Ready for inclusion.| $0| Boundary| - -**Next:** [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md deleted file mode 100644 index c01ba555ff..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Domain Isolation Policy Design Example -description: This example uses a fictitious company to illustrate domain isolation policy design in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Domain Isolation Policy Design Example - - -This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams. - -## Design Requirements - -In addition to the basic protection provided by the firewall rules in the previous design example, you might want to implement domain isolation to provide another layer of security to their networked devices. You can create firewall and connection security rules that use authentication to reduce the risk of communicating with untrusted and potentially hostile devices. - -The following illustration shows the traffic protection needed for this design example. - -![domain isolation policy design.](images/wfas-design2example1.gif) - -1. All devices on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's devices reject all unsolicited inbound network traffic that isn't authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule. - -2. The servers hosting the WGPartner programs must be able to receive unsolicited inbound traffic from devices owned by its partners, which aren't members of Woodgrove Bank's domain. - -3. Client devices can initiate non-authenticated outbound communications with devices that aren't members of the domain, such as browsing external Web sites. Unsolicited inbound traffic from non-domain members is blocked. - -4. Devices in the encryption zone require that all network traffic inbound and outbound must be encrypted, in addition to the authentication already required by the isolated domain. - -**Other traffic notes:** - -- All of the design requirements described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced. - -## Design Details - -Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the devices on its network. - -Setting up groups as described here ensures that you don't have to know what operating system a computer is running before assigning it to a group. As in the firewall policy design, a combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs. - -The following groups were created by using the Active Directory Users and Computers MMC snap-in, all devices that run Windows were added to the correct groups, and then the appropriate GPO are applied to the group. To include a device in the isolated domain or any one of its subordinate zones, add the device's account in the appropriate group. - -- **CG\_DOMISO\_ISOLATEDDOMAIN**. The members of this group participate in the isolated domain. After an initial pilot period, followed by a slowly increasing group membership, the membership of this group was eventually replaced with the entry **Domain Computers** to ensure that all devices in the domain participate by default. The WMI filters ensure that the GPO doesn't apply to domain controllers. GPOs with connection security rules to enforce domain isolation behavior are linked to the domain container and applied to the devices in this group. Filters ensure that each computer receives the correct GPO for its operating system type. The rules in the domain isolation GPO require Kerberos v5 authentication for inbound network connections, and request (but not require) it for all outbound connections. - -- **CG\_DOMISO\_NO\_IPSEC**. This group is denied read or apply permissions on any of the domain isolation GPOs. Any computer that can't participate in domain isolation, such as a DHCP server running UNIX, is added to this group. - -- **CG\_DOMISO\_BOUNDARY**. This group contains the computer accounts for all the devices that are part of the boundary group able to receive unsolicited inbound traffic from untrusted devices. Members of the group receive a GPO that configures connection security rules to request (but not require) both inbound and outbound authentication. - -- **CG\_DOMISO\_ENCRYPTION**. This group contains the computer accounts for all the devices that require all inbound and outbound traffic to be both authenticated and encrypted. Members of the group receive a GPO that configures connection security and firewall rules to require both authentication and encryption on all inbound and outbound traffic. - ->**Note:**  If you are designing GPOs for only Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - -**Next:** [Server Isolation Policy Design Example](server-isolation-policy-design-example.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md deleted file mode 100644 index abb10fe004..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Domain Isolation Policy Design -description: Learn how to design a domain isolation policy, based on which devices accept only connections from authenticated members of the same isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Domain Isolation Policy Design - - -In the domain isolation policy design, you configure the devices on your network to accept only connections coming from devices that are authenticated as members of the same isolated domain. - -This design typically begins with a network configured as described in the [Basic Firewall Policy Design](basic-firewall-policy-design.md) section. For this design, you then add connection security and IPsec rules to configure devices in the isolated domain to accept only network traffic from other devices that can authenticate as a member of the isolated domain. After the new rules are implemented, your devices reject unsolicited network traffic from devices that aren't members of the isolated domain. - -The isolated domain might not be a single Active Directory domain. It can consist of all the domains in a forest, or domains in separate forests that have two-way trust relationships configured between them. - -By using connection security rules based on IPsec, you provide a logical barrier between devices even if they're connected to the same physical network segment. - -The design is shown in the following illustration, with the arrows that show the permitted communication paths. - -![isolated domain boundary zone.](images/wfasdomainisoboundary.gif) - -Characteristics of this design, as shown in the diagram, include: - -- Isolated domain (area A) - Devices in the isolated domain receive unsolicited inbound traffic only from other members of the isolated domain or from devices referenced in authentication exemption rules. Devices in the isolated domain can send traffic to any device. This traffic includes unauthenticated traffic to devices that aren't in the isolated domain. Devices that can't join an Active Directory domain, but that can use certificates for authentication, can be part of the isolated domain. For more info, see the [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md). - -- Boundary zone (area B) - Devices in the boundary zone are part of the isolated domain but are allowed to accept inbound connections from untrusted devices, such as clients on the Internet. - - Devices in the boundary zone request but don't require authentication to communicate. When a member of the isolated domain communicates with a boundary zone member, the traffic is authenticated. When a device that isn't part of the isolated domain communicates with a boundary zone member the traffic isn't authenticated. - - Because boundary zone devices are exposed to network traffic from untrusted and potentially hostile devices, they must be carefully managed and secured. Put only the devices that must be accessed by external devices in this zone. Use firewall rules to ensure that network traffic is accepted only for services that you want exposed to non-domain member devices. - -- Trusted non-domain members (area C) - Devices on the network that aren't domain members or that can't use IPsec authentication are allowed to communicate by configuring authentication exemption rules. These rules enable devices in the isolated domain to accept inbound connections from these trusted non-domain member devices. - -- Untrusted non-domain members (area D) - Devices that aren't managed by your organization and have an unknown security configuration must have access only to those devices required for your organization to correctly conduct its business. Domain isolation exists to put a logical barrier between these untrusted Devices and your organization's devices. - -After this design is implemented, your administrative team will have centralized management of the firewall and connection security rules applied to the devices in your organization. -> [!IMPORTANT] -> This design builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md), and in turn serves as the foundation for the [Server Isolation Policy Design](server-isolation-policy-design.md). If you plan to deploy all three, we recommend that you do the design work for all three together, and then deploy in the sequence presented. - -This design can be applied to Devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. - -In order to expand the isolated domain to include Devices that can't be part of an Active Directory domain, see the [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md). - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - -- To learn more about this design, see the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md). - -- Before completing the design, gather the info described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). - -- To help you make the decisions required in this design, see [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). - -- For a list of tasks that you can use to deploy your domain isolation policy design, see [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). - -**Next:** [Server Isolation Policy Design](server-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md deleted file mode 100644 index 68f91e5710..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Enable Predefined Inbound Rules -description: Learn the rules for Windows Defender Firewall with Advanced Security for common networking roles and functions. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Enable Predefined Inbound Rules - - -Windows Defender Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a device or enable a network feature on a client device, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the devices on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To deploy predefined firewall rules that allow inbound network traffic for common network functions - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**. - -5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. By default, they're all selected. For rules that you don't want to deploy, clear the check boxes next to the rules, and then click **Next**. - -6. On the **Action** page, select **Allow the connection**, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md deleted file mode 100644 index 69eaebf470..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Enable Predefined Outbound Rules -description: Learn to deploy predefined firewall rules that block outbound network traffic for common network functions in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Enable Predefined Outbound Rules - - -By default, Windows Defender Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Defender Firewall includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically doesn't enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To deploy predefined firewall rules that block outbound network traffic for common network functions - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Outbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**. - -5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. They're all selected by default. For rules that you don't want to deploy, clear the check boxes next to the rules, and then click **Next**. - -6. On the **Action** page, select **Block the connection**, and then click **Finish**. - - The selected rules are added to the GPO. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md deleted file mode 100644 index eb9e6e58ad..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Encryption Zone GPOs -description: Learn how to add a device to an encryption zone by adding the device account to the encryption zone group in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Encryption Zone GPOs - - -Handle encryption zones in a similar manner to the boundary zones. A device is added to an encryption zone by adding the device account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the devices that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section. - -The GPO is only for server versions of Windows. Client devices aren't expected to participate in the encryption zone. If the need for one occurs, either create a new GPO for that version of Windows or expand the WMI filter attached to one of the existing encryption zone GPOs to make it apply to the client version of Windows. - -- [GPO\_DOMISO\_Encryption](gpo-domiso-encryption.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md deleted file mode 100644 index b421043953..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Encryption Zone -description: Learn how to create an encryption zone to contain devices that host sensitive data and require that the sensitive network traffic be encrypted. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Encryption Zone - - -Some servers in the organization host data that's sensitive, including medical, financial, or other personal data. Government or industry regulations might require that this sensitive information must be encrypted when it's transferred between devices. - -To support the other security requirements of these servers, we recommend that you create an encryption zone to contain the devices and that requires that the sensitive inbound and outbound network traffic is encrypted. - -You must create a group in Active Directory to contain members of the encryption zone. The settings and rules for the encryption zone are typically similar to those settings and rules for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. You then modify the security methods list to include only algorithm combinations that include encryption protocols. - -Creation of the group and how to link it to the GPOs that apply the rules to members of the group are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -## GPO settings for encryption zone servers running at least Windows Server 2008 - - -The GPO for devices that are running at least Windows Server 2008 should include: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. Check **Require encryption for all connection security rules that use these settings**, and then specify one or more integrity and encryption combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation.. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members can't use Kerberos V5 authentication, then you must include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication using the default authentication specified earlier in this policy. - - **Important**   - Be sure to begin operations by using request in and request out behavior until you're sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the GPO to require in, request out. - - - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -- If domain member devices must communicate with devices in the encryption zone, ensure that you include in the isolated domain GPOs quick mode combinations that are compatible with the requirements of the encryption zone GPOs. - -**Next:** [Planning Server Isolation Zones](planning-server-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md b/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md deleted file mode 100644 index 572b3283f3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Exempt ICMP from Authentication -description: Learn how to add exemptions for any network traffic that uses the ICMP protocol in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Exempt ICMP from Authentication - - -This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To exempt ICMP network traffic from authentication - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. On the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec settings** tab, change **Exempt ICMP from IPsec** to **Yes**, and then click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md b/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md deleted file mode 100644 index cb0b5ee9e1..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Exemption List -description: Learn about reasons to add devices to an exemption list in Windows Defender Firewall with Advanced Security and the trade-offs of having too many exemptions. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Exemption List - - -When you implement a server and domain isolation security model in your organization, you're likely to find more challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all devices on the internal network, yet secured from network attacks. However, if they must remain available to all devices on the network, not just to isolated domain members, then these servers can't require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic. - -In addition to the infrastructure servers mentioned earlier, there might also be other servers on the network that trusted devices can't use IPsec to access, which would be added to the exemption list. - -Generally, the following conditions are reasons to consider adding a device to the exemption list: - -- If the device must be accessed by trusted devices but it doesn't have a compatible IPsec implementation. - -- If the device must provide services to both trusted and untrusted devices, but doesn't meet the criteria for membership in the boundary zone. - -- If the device must be accessed by trusted devices from different isolated domains that don't have an Active Directory trust relationship established with each other. - -- If the device is a domain controller running version of Windows earlier than Windows Server 2008, or if any of its clients are running a version of Windows earlier than Windows Vista. - -- If the device must support trusted and untrusted devices, but can't use IPsec to help secure communications to trusted devices. - -For large organizations, the list of exemptions might grow large if all the exemptions are implemented by one connection security rule for the whole domain or for all trusted forests. If you can require all devices in your isolated domain to run at least Windows Vista or Windows Server 2008, you can greatly reduce the size of this list. A large exemption list has several unwanted effects on every device that receives the GPO, including the following effects: - -- Reduces the overall effectiveness of isolation. - -- Creates a larger management burden (because of frequent updates). - -- Increases the size of the IPsec policy, which means that it consumes more memory and CPU resources, slows down network throughput, and increases the time required to download and apply the GPO containing the IPsec policy. - -To keep the number of exemptions as small as possible, you have several options: - -- Carefully consider the communications requirements of each isolation zone, especially server-only zones. They might not be required to communicate with every exemption in the domain-level policy for clients. - -- Consolidate server functions. If several exempt services can be hosted at one IP address, the number of exemptions is reduced. - -- Consolidate exempted hosts on the same subnet. Where network traffic volume allows, you might be able to locate the servers on a subnet that is exempted, instead of using exemptions for each IP address. - -As with defining the boundary zone, create a formal process to approve hosts being added to the exemption list. For a model of processing requests for exemptions, see the decision flowchart in the [Boundary Zone](boundary-zone.md) section. - -**Next:** [Isolated Domain](isolated-domain.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md deleted file mode 100644 index 526ffd83a3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -title: Firewall GPOs -description: In this example, a Group Policy Object is linked to the domain container because the domain controllers aren't part of the isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Firewall GPOs - - -All the devices on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters. - -The GPO created for the example Woodgrove Bank scenario includes [GPO\_DOMISO\_Firewall](gpo-domiso-firewall.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md deleted file mode 100644 index f290a9943c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Basic Firewall Policy Design Example -description: This example features a fictitious company and illustrates firewall policy design for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Basic Firewall Policy Design Example - - -In this example, the fictitious company Woodgrove Bank is a financial services institution. - -Woodgrove Bank has an Active Directory domain that provides Group Policy-based management for all their Windows devices. The Active Directory domain controllers also host Domain Name System (DNS) for host name resolution. Separate devices host Windows Internet Name Service (WINS) for network basic input/output system (NetBIOS) name resolution. A set of devices that are running UNIX provide the Dynamic Host Configuration Protocol (DHCP) services for automatic IP addressing. - -Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. - -A key line-of-business program called WGBank consists of a client program running on most of the desktop devices in the organization. This program accesses several front-end server devices that run the server-side part of WGBank. These front-end servers only do the processing—they don't store the data. The data is stored in several back-end database devices that are running Microsoft SQL Server. - -## Design requirements - -The network administrators want to implement Windows Defender Firewall with Advanced Security throughout their organization to provide another security layer to their overall security strategy. They want to create firewall rules that allow their business programs to operate, while blocking network traffic that isn't wanted. - -The following illustration shows the traffic protection needs for this design example. - -![design example 1.](images/wfas-designexample1.gif) - -1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers. - -2. The WGBank front-end servers can receive unsolicited inbound traffic from the client devices and the WGBank partner servers. The WGBank client devices and partner servers can receive the response. - -3. The WGBank front-end servers can send updated information to the client devices to support real-time display. The clients don't poll for this unsolicited traffic, but must be able to receive it. - -4. The WGBank back-end servers can receive SQL query requests from the WGBank front-end servers. The WGBank front-end servers can receive the corresponding responses. - -5. There's no direct communications between the client devices and the WGBank back-end devices. - -6. There's no unsolicited traffic from the WGBank back-end devices to the WGBank front-end servers. - -7. Company policy prohibits the use of peer-to-peer file transfer software. A recent review by the IT staff found that although the perimeter firewall does prevent most of the programs in this category from working, two programs are being used by staff members that don't require an outside server. Firewall rules must block the network traffic created by these programs. - -8. The WGBank partner servers can receive inbound requests from partner devices through the Internet. - -Other traffic notes: - -- Devices aren't to receive any unsolicited traffic from any computer other than allowed above. - -- Other outbound network traffic from the client devices not identified in this example is permitted. - -## Design details - - -Woodgrove Bank uses Active Directory groups and Group Policy Objects to deploy the firewall settings and rules to the devices on their network. They know that they must deploy policies to the following collections of devices: - -- Client devices that run Windows 11, Windows 10, Windows 8, or Windows 7 - -- WGBank front-end servers that run Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) - -- WGBank partner servers that run Windows Server 2008 - -- WGBank back-end SQL Server devices that run Windows Server 2008 (there are none in place yet, but their solution must support adding them) - -- Infrastructure servers that run Windows Server 2008 - -- Active Directory domain controllers that run Windows Server 2008 R2 or Windows Server 2012 - -- DHCP servers that run the UNIX operating system - -After the Woodgrove Bank network administrators evaluated these sets of devices, and compared them to the Active Directory organizational unit (OU) structure, they determined that there wasn't a good one-to-one match between the OUs and the sets. Therefore the firewall GPOs won't be linked directly to OUs that hold the relevant devices. Instead, the GPOs are linked to the domain container in Active Directory, and then WMI and group filters are attached to the GPO to ensure that it's applied to the correct devices. - -Setting up groups as described here ensures that you don't have to know what operating system a computer is running before assigning it to a group. A combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs. - -The following groups were created by using the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, and all devices that run Windows were added to the correct groups: - -- **CG\_FIREWALL\_ALLCOMPUTERS**. Add the predefined and system managed **Domain computers** group as a member of this group. All members of the FIREWALL\_ALLCOMPUTERS group receive an operating system-specific GPO with the common firewall rules applied to all devices. - - The two device types (client and server) are distinguished by using a WMI filters to ensure that only the policy intended for devices that are running a client version of Windows can be applied to that computer. A similar WMI filter on the server GPO ensures that only devices that are running server versions of Windows can apply that GPO. Each of the GPOs also has security group filters to prevent members of the group FIREWALL\_NO\_DEFAULT from receiving either of these two GPOs. - - - Client devices receive a GPO that configures Windows Defender Firewall to enforce the default Windows Defender Firewall behavior (allow outbound, block unsolicited inbound). The client default GPO also includes the built-in firewall rule groups Core Networking and File and Printer Sharing. The Core Networking group is enabled for all profiles, whereas the File and Printer Sharing group is enabled for only the Domain and Private profiles. The GPO also includes inbound firewall rules to allow the WGBank front-end server dashboard update traffic, and rules to prevent company-prohibited programs from sending or receiving network traffic, both inbound and outbound. - - - Server devices receive a GPO that includes similar firewall configuration to the client computer GPO. The primary difference is that the rules are enabled for all profiles (not just domain and private). Also, the rules for WGBank dashboard update aren't included, because it's not needed on server devices. - - All rules are scoped to allow network traffic only from devices on Woodgrove Bank's corporate network. - -- **CG\_FIREWALL\_NO\_DEFAULT**. Members of this group don't receive the default firewall GPO. Devices are added to this group if there's a business requirement for it to be exempted from the default firewall behavior. The use of a group to represent the exceptions instead of the group members directly makes it easier to support the dynamic nature of the client computer population. A new computer joined to the domain is automatically given the appropriate default firewall GPO, unless it's a member of this group. - -- **CG\_FIREWALL\_WGB\_FE**. This group contains the computer accounts for all the WGBank front-end server devices. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow unsolicited WGBank client traffic. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_WGB\_SQL**. This group contains the computer accounts for all the WGBank back-end devices that run SQL Server. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow the SQL Server program to receive unsolicited queries only from the WGBank front-end servers. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_BOUNDARY\_WGBANKFE**. This group contains the computer accounts for the servers that host Web services that can be accessed from the Internet. Members of this group receive a GPO that adds an inbound firewall rule to allow inbound HTTP and HTTPS network traffic from any address, including the Internet. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_WINS**. This group contains the computer accounts for all the WINS server devices. Members of this group receive a GPO that configures Windows Defender Firewall with an inbound firewall rule to allow unsolicited inbound requests from WINS clients. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_ADDC**. This group contains all the computer accounts for the Active Directory domain controller server devices. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow unsolicited Active Directory client and server-to-server traffic. Devices in this group also receive the default firewall GPO. - -In your own design, create a group for each computer role in your organization that requires different or more firewall rules. For example, file servers and print servers require more rules to allow the incoming network traffic for those functions. If a function is ordinarily performed on most devices on the network, you might consider adding devices performing those roles to the common default firewall GPO set, unless there's a security reason not to include it there. - -**Next:** [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md deleted file mode 100644 index b030f3c63a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Gathering Information about Your Active Directory Deployment -description: Learn about gathering Active Directory information, including domain layout, organizational unit architecture, and site topology, for your firewall deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Active Directory Deployment - - -Active Directory is another important item about which you must gather information. You must understand the forest structure. This structure includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where devices are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Defender Firewall with Advanced Security. Review the following list for information needed: - -- **Names and number of forests**. The forest (not the domain) is the security boundary in an Active Directory implementation. You must understand the current Active Directory architecture to determine the most effective strategy for deploying your firewall and connection security rules using Group Policy. It also enables you to understand which devices can be isolated and how best to accomplish the required degree of isolation. - -- **Names and number of domains**. Authentication in server and domain isolation uses the IKE negotiation process with the Kerberos V5 protocol. This protocol assumes that devices are domain members. - -- **Number and types of trusts**. Trusts affect the logical boundaries of domain isolation and define whether IKE negotiation can occur between devices in different Active Directory domains. - -- **Names and number of sites**. Site architecture is aligned with the network topology. Understanding how sites are defined in Active Directory will help provide insight into replication and other details. Site architecture can provide a better understanding of the current Active Directory deployment. - -- **OU structure**. OUs are logical constructs and can therefore be molded to fit many different requirements and goals. The OU structure is an ideal place to examine how Group Policy is currently used and how the OUs are laid out. You don't have to redesign an already implemented OU structure in order to effectively deploy firewall and connection security policy, but an understanding of the structure helps you know what WMI or group filtering is required to apply each GPO to the correct devices. - -- **Existing IPsec policy**. Because this project culminates in the implementation of IPsec policy, you must understand how the network currently uses IPsec (if at all). Windows Defender Firewall connection security rules for versions of Windows prior to Windows Vista and Windows Server 2008 aren't compatible with earlier versions of Windows. If you already have IPsec policies deployed to devices running Windows XP and Windows Server 2003 in your organization, you must ensure that the new IPsec policies you deploy enable devices using either the old or new IPsec policies to communicate with each other. - -**Next:** [Gathering Information about Your Devices](gathering-information-about-your-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md deleted file mode 100644 index 13cb71d95b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Gathering Info about Your Network Infrastructure -description: Learn how to gather info about your network infrastructure so that you can effectively plan for Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Current Network Infrastructure - - -Perhaps the most important aspect of planning for Windows Defender Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Defender Firewall solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project: - -- **Network segmentation**. This component includes IP addressing maps, showing how your routers separate each network segment. It includes information about how the routers are configured, and what security filters they impose on network traffic flowing through them. - -- Network address translation (NAT). NAT is a means of separating network segments by using a device that maps all of the IP addresses on one side of the device to a single IP address accessible on the other side. - -- Network infrastructure devices. These devices include the routers, switches, hubs, and other network equipment that makes communications between the devices on the network possible. - -- **Current network traffic model.** This component includes the quantity and the characteristics of the network traffic flowing through your network. - -- Intrusion Detection System (IDS) devices. You'll need to identify if you have any IDS devices on your network that might be negatively impacted by any encryption introduced in an Encryption Zone. - -The goal is to have enough information to be able to identify an asset by its network location, in addition to its physical location. - -Don't use a complex and poorly documented network as a starting point for the design, because it can leave too many unidentified areas that are likely to cause problems during implementation. - -This guidance helps obtain the most relevant information for planning Windows Defender Firewall implementation, but it doesn't try to address other issues, such as TCP/IP addressing or virtual local area network (VLAN) segmentation. - -## Network segmentation - - -If your organization doesn't have its current network architecture documented and available for reference, such documentation should be obtained as soon as possible before you continue with the design and deployment. If the documented information isn't current or hasn't been validated recently, you have two options: - -- Accept that the lack of accurate information can cause risk to the project. - -- Undertake a discovery project, either through manual processes or with network analysis tools that can provide the information you need to document the current network topology. - -Although the required information can be presented in many different ways, a series of schematic diagrams is often the most effective method of illustrating and understanding the current network configuration. When creating network diagrams, don't include too much information. If necessary, use multiple diagrams that show different layers of detail. Use a top-level diagram that illustrates the major sites that make up your organization's network, and then break out each site into a more detailed diagram that captures a deeper level of detail. Continue until you reach the individual IP subnet level, and so have the means to identify the network location of every device in your organization. - -During this process, you might discover some network applications and services that aren't compatible with IPsec. For example, IPsec breaks network-based prioritization and port/protocol-based traffic management. If traffic management or prioritization must be based on ports or protocol, the host itself must be able to perform any traffic management or prioritization. - -Other examples of incompatibility include: - -- Cisco NetFlow on routers can't analyze packets between IPsec members based on protocol or port. - -- Router-based Quality of Service (QoS) can't use ports or protocols to prioritize traffic. However, using firewall rules that specify IP addresses to prioritize traffic aren't affected by this limitation of QoS. For example, a rule that says "From anyone to anyone using port 80 prioritize" doesn't work, but a rule that says "From anyone to 10.0.1.10 prioritize" works. - -- Weighted Fair Queuing and other flow-based router traffic priority methods might fail. - -- Devices that don't support or allow IP protocol 50, the port that is used by Encapsulating Security Payload (ESP). - -- Router access control lists (ACLs) can't examine protocol and port fields in ESP-encrypted packets, and therefore the packets are dropped. ACLs based only on IP address are forwarded as usual. If the device can't parse ESP, any ACLs that specify port or protocol rules won't be processed on the ESP packets. If the device has an ESP parser and uses encryption, ACLs that specify port or protocol rules won't be processed on the ESP packets. - -- Network monitoring tools might be unable to parse ESP packets that aren't encrypted (ESP-Null). - - >**Note:**  Microsoft Message Analyzer can help in troubleshooting of unencrypted IPsec packets. The latest version of Message Analyzer is available on the [Microsoft Download Center](/message-analyzer/microsoft-message-analyzer-operating-guide). -   -## Network address translation (NAT) - -IPsec NAT traversal (NAT-T) enables IPsec peers that are behind NATs to detect the presence of NATs, negotiate IPsec security associations (SAs), and send ESP-protected data even though the addresses in the IPsec-protected IPv4 packets change. IPsec NAT-T doesn't support the use of AH across NAT devices. - -## Network infrastructure devices - -The devices that make up the network infrastructure (routers, switches, load balancers, and firewalls) must be able communicate using IPsec after the solution is implemented. For this reason, you have to examine the following characteristics of these network devices to ensure that they can handle the technical and physical requirements of the design: - -- **Make/model**. You can use this information to determine the features that the device supports. In addition, check the BIOS version or software running on the device to ensure that IPsec is supported. - -- **Amount of RAM**. This information is useful when you're analyzing capacity or the impact of IPsec on the device. - -- **Traffic analysis**. Information, such as peak usage and daily or weekly trends, is helpful to have. The information helps provide a baseline snapshot of the device and how it's used over time. If problems occur after IPsec is implemented, the information can help determine whether the root cause is related to greater usage of the device. - -- **Router ACLs that affect IPsec directly**. ACLs directly affect the ability of specific protocols to function. For example, blocking the Kerberos V5 protocol (UDP and TCP port 88) or IP protocol 50 or 51 prevents IPsec from working. Devices must also be configured to allow IKE traffic (UDP port 500) if using NAT-T (UDP port 4500). - -- **Networks/subnets connected to device interfaces**. This information provides the best picture of what the internal network looks like. Defining the boundary of subnets based on an address range is straightforward and helps identify whether other addresses are either unmanaged or foreign to the internal network (such as IP addresses on the Internet). - -- **VLAN segmentation**. Determining how VLANs are implemented on the network can help you understand traffic patterns and security requirements, and then help to determine how IPsec might augment or interfere with these requirements. - -- **The maximum transmission unit (MTU) size on device interface(s)**. The MTU defines the largest datagram that can be transmitted on a particular interface without being divided into smaller pieces for transmission (a process also known as *fragmentation*). In IPsec communications, the MTU is necessary to anticipate when fragmentation occurs. Packet fragmentation must be tracked for Internet Security Association and Key Management Protocol (ISAKMP) by the router. IPsec configures the MTU size on the session to the minimum-discovered MTU size along the communication path being used, and then set the Don't Fragment bit (DF bit) to 1. - - >**Note:**  If Path MTU (PMTU) discovery is enabled and functioning correctly, you do not have to gather the MTU size on device interfaces. Although sources, such as the Windows Server 2003 Hardening Guide, recommend disabling PMTU discovery, it must be enabled for IPsec to function correctly. - -- **Intrusion detection system (IDS) in use**. Your IDS must have an IPsec-compatible parser to detect ESP packets. If the IDS doesn't have such a parser, it can't determine if data in those packets is encrypted. - -After you obtain this information, you can quickly determine whether you must upgrade the devices to support the requirements of the project, change the ACLs, or take other measures to ensure that the devices can handle the loads needed. - -## Current network traffic model - -After you gather the addressing and network infrastructure information, the next step is to examine the communications flow. For example, if a department such as Human Resources (HR) spans several buildings, and you want to use server isolation with encryption to help protect information in that department, you must know how those buildings are connected to determine the level of "trust" to place in the connection. A highly secured building that is connected by an unprotected cable to another building that isn't secured can be compromised by an eavesdropping or information replay attack. If such an attack is considered a threat, IPsec can help by providing strong mutual authentication and traffic encryption for trusted hosts. IPsec allows you to more securely communicate across untrusted links such as the Internet. - -When you examine traffic flow, look closely at how all managed and unmanaged devices interact. These devices include non-Windows-based devices running Linux, UNIX, and Macintosh. Ask yourself such questions as: - -- Do specific communications occur at the port and protocol level, or are there many sessions between the same hosts across many protocols? - -- How do servers and clients communicate with each other? - -- Are there security devices or projects currently implemented or planned that could affect an isolation deployment? For example, if you use Windows Defender Firewall on your devices to "lock down" specific ports, such as UDP 500, IKE negotiations fail. - -Some of the more common applications and protocols are as follows: - -- **NetBIOS over TCP/IP (NetBT) and server message block (SMB)**. On a LAN, it's common to have ports 137, 138, and 139 enabled for NetBT and port 445 enabled for SMB. These ports provide NetBIOS name resolution services and other features. Unfortunately, they also allow the creation of *null sessions*. A null session is a session that is established on a host that doesn't use the security context of a known user or entity. Frequently, these sessions are anonymous. - -- **Remote procedure call (RPC)**. RPC operates by listening on a port known as the *endpoint mapper*, TCP port 135. The response to a query on this port is an instruction to begin communication on another port in the ephemeral range (ports numbered over 1024). In a network that is segmented by firewalls, RPC communication presents a configuration challenge because it means to open the RPC listener port, and all ports greater than 1024. Opening so many ports increases the attack surface of the whole network and reduces the effectiveness of the firewalls. Because many applications depend on RPC for basic functionality, any firewall and connection security policy must take RPC requirements into account. - -- **Other traffic**. Windows Defender Firewall can help secure transmissions between devices by providing authentication of the packets in addition to encrypting the data that they contain. The important thing to do is to identify what must be protected, and the threats that must be mitigated. Examine and model other traffic or traffic types that must be secured. - -**Next:** [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md deleted file mode 100644 index d650107dd8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Gathering Information about Your Devices -description: Learn what information to gather about the devices in your enterprise to plan your Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Devices - - -One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server devices on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned. - -Capture the following information from each device: - -- **Computer name**. This name is the device's NetBIOS or DNS name that identifies the device on the network. Because a device can have more than one media access control (MAC) or IP address, the device's name is one of the criteria that can be used to determine uniqueness on the network. Because device names can be duplicated under some circumstances, the uniqueness shouldn't be considered absolute. - -- **IP address for each network adapter**. The IP address is the address that is used with the subnet mask to identify a host on the network. An IP address isn't an effective way to identify an asset because it's often subject to change. - -- **Operating system, service pack, and hotfix versions**. The operating system version is a key factor in determining the ability of a host to communicate by using IPsec. It's also important to track the current state of service packs and updates that might be installed, because these packs and updates are often used to determine that minimum security standards have been met. - -- **Domain membership**. This information is used to determine whether a device can obtain IPsec policy from Active Directory or whether it must use a local IPsec policy. - -- **Physical location**. This information is just the location of the device in your organization. It can be used to determine whether a device can participate in a specific isolation group based on its location or the location of the devices that it communicates with regularly. - -- **Hardware type or role**. Some tools that perform host discovery can provide this information by querying the hardware information and running applications to determine its type, such as server, workstation, or portable device. You can use this information to determine the appropriate IPsec policy to assign, whether a specific device can participate in isolation, and in which isolation group to include the device. - -After collecting all this information and consolidating it into a database, perform regular discovery efforts periodically to keep the information current. You need the most complete and up-to-date picture of the managed hosts on their networks to create a design that matches your organization's requirements. - -You can use various methods to gather data from the hosts on the network. These methods range from high-end, fully automated systems to manual data collection. Generally, the use of automated methods to gather data is preferred over manual methods for reasons of speed and accuracy. - -## Automated Discovery - -Using an automated auditing network management system provides valuable information about the current state of the IT infrastructure. - - -## Manual Discovery - - -The biggest difference between manual discovery methods and automated methods is time. - -You can use Windows PowerShell to create a script file that can collect the system configuration information. For more information, see [Windows PowerShell Scripting](https://go.microsoft.com/fwlink/?linkid=110413). - -Whether you use an automatic, manual, or hybrid option to gather the information, one of the biggest issues that can cause problems to the design is capturing the changes between the original inventory scan and the point at which the implementation is ready to start. After the first scan has been completed, make support staff aware that all other changes must be recorded and the updates noted in the inventory. - -This inventory will be critical for planning and implementing your Windows Defender Firewall design. - -**Next:** [Gathering Other Relevant Information](gathering-other-relevant-information.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md deleted file mode 100644 index f57dfc3116..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Gathering Other Relevant Information -description: Learn about additional information you may need to gather to deploy Windows Defender Firewall with Advanced Security policies in your organization. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Other Relevant Information - - -This topic discusses several other things that you should examine to see whether they'll cause any complications in your ability to deploy Windows Defender Firewall with Advanced Security policies in your organization. - -## Capacity considerations - -Because IPsec uses mathematically intensive cryptographic techniques, it can consume significant overhead on a device. Areas to watch: - -- **Encryption.** You might use 256-bit Advanced Encryption Standard (AES-256) and 384-bit Secure Hash Algorithm (SHA-384) to check integrity in situations that require the strongest available encryption and key exchange protection. If you have NICs that support IPsec Task Offload, you can reduce the effect that encryption has on network throughput. For more information, see [IPsec Task Offload](/previous-versions/windows/it-pro/windows-server-2003/cc776369(v=ws.10)). - -- **Security association (SA) negotiation.** You can use a shorter lifetime for the main mode SA, such as three hours, but then you might need to make tradeoffs. Because each main mode SA occupies approximately 5  KB of RAM, situations in which a server brokers tens of thousands of concurrent connections can lead to overutilization. - -- **NAT devices.** As discussed earlier, NAT doesn't allow Authentication Header (AH) conversations between hosts. If NAT devices exist on the internal network, ESP must be selected instead of AH. - -- **Switches and routers.** Proper capacity planning for the implementation of IPsec is more about thorough testing and expected traffic loads than exact calculations. You might have to upgrade or reconfigure switches or routers that currently exceed 75 percent usage to allow for increased traffic on the device and still provide some extra usage for bursts of traffic. - -- **Other factors.** These include CPU usage on network infrastructure servers, increased overhead on servers and workstations running IPsec (especially servers, because they usually contain more main mode SAs than clients), and increased network latency because of IPsec negotiation. - - >**Note:**  When Microsoft deployed its own domain isolation solution, it found a one to three percent increase in usage on the network as a direct result of IPsec. - -## Group Policy deployment groups and WMI filters - -You don't have to rearrange the organization unit (OU) hierarchy of your Active Directory domains to effectively deploy Windows Defender Firewall GPOs. Instead, you can link your GPOs at the domain level (or another high level container), and then use security group filtering or WMI filtering to ensure that only the appropriate devices or users can apply the GPO settings. We recommend that you use WMI filtering to dynamically ensure that GPOs apply only to devices that are running the correct operating system. It's not necessary to use this technique if your network consists of devices. - -## Different Active Directory trust environments - -When you design a domain isolation policy, consider any logical boundaries that might affect IPsec-secured communications. For example, the trust relationships between your domains and forests are critical in determining an appropriate IKE authentication method. - -Kerberos V5 authentication is recommended for use in a two-way (mutual) domain and forest trust environment. You can use Kerberos V5 for IKE authentication across domains that have two-way trusts established, if the domains are in the same forest or different forests. If the two domains are in different forests, you must configure two external trusts, one for each direction, between the domains. The external trusts must use the fully qualified domain name (FQDN) of the domains, and IPsec policy must allow an IKE initiator in one domain to communicate with any domain controller in the forest domain hierarchy, so that the initiator can obtain a Kerberos V5 ticket from a domain controller in the responder’s domain. If firewalls separate the domains, then you must configure the firewall to allow Kerberos V5 traffic over UDP destination port 88, TCP destination port 88, and UDP destination port 389. - -If the use of Kerberos V5 authentication isn't possible because two-way trusts across forests can't be established as in some large enterprise environments, you can use a public key infrastructure (PKI) and digital certificates to establish IPsec-trusted communication. - -## Creating firewall rules to permit IKE, AH, and ESP traffic - - -In some cases, IPsec-secured traffic might have to pass through a router, perimeter firewall, or other filtering device. If there's a router, unless the router filters TCP and UDP traffic or other upper-level protocol headers, no special configuration is required to allow the IPsec traffic to be forwarded. - -If there's a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected. - -## Network load balancing and server clusters - -There are challenges implementing connection security for network traffic going to and from network load balancing (NLB) clusters and server clusters. NLB enables multiple servers to be clustered together to provide high availability for a service by providing automatic failover to other nodes in the cluster. Because IPsec matches a security association to a specific device, it prevents different devices from handling the same client connection. If a different node in the cluster responds to an IPsec connection that was originally established by another node, the traffic will be dropped by the client device as untrusted. - -This dropping of traffic means that NLB in "no affinity" mode isn't supported by IPsec at all. If you must use "no affinity" mode in the cluster, then consider including the servers that make up the cluster in your IPsec exemption group, and allowing clients to communicate with the servers without IPsec. - -When a TCP connection is dropped because of a cluster node failover, IPsec detects the TCP connection failure and removes the IPsec SAs for that connection. When the new TCP connection is established to another node, IPsec can negotiate new SAs immediately without having to wait for the obsolete SAs to time out. - -## Network inspection technologies - -Within a TCP/IP packet, IPsec without encryption changes the offsets for the destination ports and protocols. These changes can adversely affect applications that are running on network devices such as routers that monitor and manage traffic on the network. While some network applications have been updated to support IPsec, some aren't yet compatible. Check with the vendor of your device to see whether the changes in the protocol and port fields caused by IPsec are compatible with the device. - -Any device designed to view network traffic, such as hardware protocol analyzers or Microsoft Network Monitor, can't parse ESP-encrypted traffic. Only the destination device, with which the originating device negotiated the connection, can decrypt the traffic. - -In general, IPsec defeats network-based prioritization and port- or protocol-based traffic management. For encrypted packets, there's no workaround; the host itself must handle any traffic management functions. For unencrypted, authenticated-only packets, the devices and applications must be aware of how IPsec changes packets to be able to do anything with them other than route them to the correct host. If you can't upgrade monitoring or management devices to support IPsec, it's important that you record this information and figure it into your domain or server isolation design. - -Network Monitor includes parsers for the ISAKMP (IKE), AH, and ESP protocols. Network Monitor parsers for ESP can parse inside the ESP packet only if ESP null-encryption is being used. Network Monitor can't parse the encrypted parts of IPsec ESP traffic when encryption is performed in software. However, if encryption is performed by an IPsec hardware offload network adapter, the ESP packets can be decrypted when Network Monitor captures them on either the source or the destination and, therefore, they can be parsed. To diagnose ESP software-encrypted communication, you must disable ESP encryption and use ESP-null encryption by changing the IPsec policy or connection security rule on both devices. - -Message Analyzer is available on the [Microsoft Download Center](/message-analyzer/microsoft-message-analyzer-operating-guide). - -**Next:** [Determining the Trusted State of Your Devices](determining-the-trusted-state-of-your-devices.md) \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md deleted file mode 100644 index b82d977445..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Gathering the Information You Need -description: Collect and analyze information about your network, directory services, and devices to prepare for Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering the Information You Need - - -Before starting the planning process for a Windows Defender Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the devices that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information isn't accurate, problems can occur when devices and devices that weren't considered during the planning phase are encountered during implementation. - -Review each of the following articles for guidance about the kinds of information that you must gather: - -- [Gathering Information about Your Conversational Network Infrastructure](gathering-information-about-your-current-network-infrastructure.md) - -- [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md) - -- [Gathering Information about Your Devices](gathering-information-about-your-devices.md) - -- [Gathering Other Relevant Information](gathering-other-relevant-information.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md deleted file mode 100644 index 741f91081d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: GPO\_DOMISO\_Boundary -description: This example GPO supports devices that aren't part of the isolated domain to access specific servers that must be available to those untrusted devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Boundary - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. - -This GPO supports the ability for devices that aren't part of the isolated domain to access specific servers that must be available to those untrusted devices. It's intended to only apply to server devices that are running at least Windows Server 2008. - -## IPsec settings - -The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain when authentication can be used. - -## Connection security rules - - -Rename the **Isolated Domain Rule** to **Boundary Zone Rule**. Change the authentication mode to **Request inbound and request outbound**. In this mode, the device uses authentication when it can, such as during communication with a member of the isolated domain. It also supports the "fall back to clear" ability of request mode when an untrusted device that isn't part of the isolated domain connects. - -## Registry settings - - -The boundary zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -## Firewall rules - - -Copy the firewall rules for the boundary zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other devices. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 80 for Web client requests. - -Make sure that the GPO that contains firewall rules for the isolated domain doesn't also apply to the boundary zone to prevent overlapping, and possibly conflicting rules. - -**Next:** [Encryption Zone GPOs](encryption-zone-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md deleted file mode 100644 index b5d7b1384b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: GPO\_DOMISO\_Encryption\_WS2008 -description: This example GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. -ms.topic: conceptual -ms.prod: windows-client -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Encryption\_WS2008 - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. - -This GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. It's intended to only apply to server computers that are running Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. - -## IPsec settings - - -The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain. The following changes are made to encryption zone copy of the GPO: - -The encryption zone servers require all connections to be encrypted. To do this encryption, change the IPsec default settings for the GPO to enable the setting **Require encryption for all connection security rules that use these settings**. This setting disables all integrity-only algorithm combinations. - -## Connection security rules - - -Rename the **Isolated Domain Rule** to **Encryption Zone Rule**. Leave the authentication mode setting on **Require inbound and request outbound**. In this mode, the computer forces authentication for all inbound network traffic, and uses it when it can on outbound traffic. - -## Registry settings - - -The encryption zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -## Firewall rules - - -Copy the firewall rules for the encryption zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other computers. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 1433 for SQL Server client requests. - -Change the action for every inbound firewall rule from **Allow the connection** to **Allow only secure connections**, and then select **Require the connections to be encrypted**. - -Make sure that the GPO that contains firewall rules for the isolated domain doesn't also apply to the boundary zone to prevent overlapping, and possibly conflicting rules. - -**Next:** [Server Isolation GPOs](server-isolation-gpos.md) - -  - -  - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md deleted file mode 100644 index 057cf7bdf5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: GPO\_DOMISO\_Firewall -description: Learn about the settings and rules in this example GPO, which is authored by using the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Firewall - - -This GPO is authored by using the Windows Defender Firewall -with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to devices that are running at least Windows 7 or Windows Server 2008. - -## Firewall settings - -This GPO provides the following settings: - -- Unless otherwise stated, the firewall rules and settings described here are applied to all profiles. - -- The firewall is enabled, with inbound, unsolicited connections blocked and outbound connections allowed. - -- Under the domain profile, the settings **Display notifications to the user**, **Apply local firewall rules**, and **Apply local connection security rules** are all set to **No**. These settings are applied only to the domain profile because the devices can only receive an exception rule for a required program from a GPO if they are connected to the domain. Under the public and private profiles, those settings are all set to **Yes**. - - >**Note:**  Enforcing these settings requires that you define any firewall exceptions for programs, because the user cannot manually permit a new program. You must deploy the exception rules by adding them to this GPO. We recommend that you do not enable these settings until you have tested all your applications and have tested the resulting rules in a test lab and then on pilot devices. - -## Firewall rules - -This GPO provides the following rules: - -- Built-in firewall rule groups are configured to support typically required network operation. The following rule groups are set to **Allow the connection**: - - - Core Networking - - - File and Printer Sharing - - - Network Discovery - - - Remote Administration - - - Remote Desktop - - - Remote Event Log Management - - - Remote Scheduled Tasks Management - - - Remote Service Management - - - Remote Volume Management - - - Windows Defender Firewall Remote Management - - - Windows Management Instrumentation (WMI) - - - Windows Remote Management - -- A firewall exception rule to allow required network traffic for the WGBank dashboard program. This inbound rule allows network traffic for the program Dashboard.exe in the %ProgramFiles%\\WGBank folder. The rule is also filtered to only allow traffic on port 1551. This rule is applied only to the domain profile. - -**Next:** [Isolated Domain GPOs](isolated-domain-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md deleted file mode 100644 index 1f72fa6064..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: GPO\_DOMISO\_IsolatedDomain\_Clients -description: Author this GPO by using Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_IsolatedDomain\_Clients - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to client devices that are running Windows 8, Windows 7, or Windows Vista. - -Because client devices can sometimes be portable, the settings and rules for this GPO are applied to only the domain profile. - -## General settings - -This GPO provides the following settings: - -- No firewall settings are included in this GPO. Woodgrove Bank created separate GPOs for firewall settings (see the [Firewall GPOs](firewall-gpos.md) section) in order to share them with all clients in all isolation zones with minimum redundancy. - -- The ICMP protocol is exempted from authentication requirements to support easier network troubleshooting. - -- Diffie-Hellman Group 2 is specified as the key exchange algorithm. This algorithm is the strongest algorithm available that is supported by all the operating systems that are being used at Woodgrove Bank. After Woodgrove Bank has completed the upgrade to versions of Windows that support stronger algorithms, they can remove the weaker key exchange algorithms, and use only the stronger ones. - -- The registry settings shown in the following table. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -| Setting | Value | -| - | - | -| Enable PMTU Discovery | 1 | -| IPsec Exemptions | 3 | - -- The main mode security method combinations in the order shown in the following table. - -| Integrity | Encryption | -| - | - | -| Secure Hash Algorithm (SHA-1) | Advanced Encryption Standard (AES-128) | -| SHA-1 | 3DES | - -- The following quick mode security data integrity algorithms combinations in the order shown in the following table. - -| Protocol | Integrity | Key Lifetime (minutes/KB) | -| - | - | - | -| ESP | SHA-1 | 60/100,000 | - -- The quick mode security data integrity and encryption algorithm combinations in the order shown in the following table. - -| Protocol | Integrity | Encryption | Key Lifetime (minutes/KB) | -| - | - | - | - | -| ESP | SHA-1 | AES-128 | 60/100,000| -| ESP | SHA-1 | 3DES | 60/100,000| - ->**Note:**  Do not use the MD5 and DES algorithms in your GPOs. They are included only for compatibility with previous versions of Windows. - -## Connection Security Rules - -This GPO provides the following rules: - -- A connection security rule named **Isolated Domain Rule** with the following settings: - - - From **Any IP address** to **Any IP address**. - - - **Require inbound and request outbound** authentication requirements. - - >**Important:**  On this, and all other GPOs that require authentication, Woodgrove Bank first chose to only request authentication. After confirming that the devices were successfully communicating by using IPsec, they switched the GPOs to require authentication. - - - For **First authentication methods**, select **Computer Kerberos v5** as the primary method. Add certificate-based authentication from **DC=com,DC=woodgrovebank,CN=CorporateCertServer** for devices that can't run Windows or can't join the domain, but must still participate in the isolated domain. - - - For **Second authentication**, select **User Kerberos v5**, and then select the **Second authentication is optional** check box. - -- A connection security rule to exempt devices that are in the exemption list from the requirement to authenticate: - - - The IP addresses of all devices on the exemption list must be added individually under **Endpoint 2**. - - - Authentication mode is set to **Do not authenticate**. - -**Next:** [GPO\_DOMISO\_IsolatedDomain\_Servers](gpo-domiso-isolateddomain-servers.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md deleted file mode 100644 index 2ca05d9120..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: GPO\_DOMISO\_IsolatedDomain\_Servers -description: Author this GPO by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_IsolatedDomain\_Servers - - -This GPO is authored by using the Windows Defender Firewall interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to server devices that are running at least Windows Server 2008. - -Because so many of the settings and rules for this GPO are common to those settings and rules in the GPO for at least Windows Vista, you can save time by exporting the Windows Defender Firewall piece of the GPO for at least Windows Vista, and importing it to the GPO for at least Windows Server 2008. After the import, change only the items specified here: - -- This GPO applies all its settings to all profiles: Domain, Private, and Public. Because a server isn't expected to be mobile and changing networks, configuring the GPO in this way prevents a network failure or the addition of a new network adapter from unintentionally switching the device to the Public profile with a different set of rules (the example of a server running Windows Server 2008). - - >**Important:**  Windows Vista and Windows Server 2008 support only one network location profile at a time. The profile for the least secure network type is applied to the device. If you attach a network adapter to a device that is not physically connected to a network, the public network location type is associated with the network adapter and applied to the device. - -**Next:** [Boundary Zone GPOs](boundary-zone-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md deleted file mode 100644 index c36d7effdf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Identify implementation goals for Windows Defender Firewall with Advanced Security Deployment -description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) implementation goals -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Identifying Windows Defender Firewall with Advanced Security implementation goals - -Correctly identifying your Windows Defender Firewall with Advanced Security implementation goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your implementation goals. Prioritize and, if possible, combine your implementation goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall implementation goals presented in this guide that are relevant to your scenarios. - -The following table lists the three main tasks for articulating, refining, and later documenting your Windows Defender Firewall implementation goals: - - -| Deployment goal tasks | Reference links | -|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Evaluate predefined Windows Defender Firewall with Advanced Security implementation goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined implementation goals:

| -| Map one goal or a combination of the predefined implementation goals to an existing Windows Defender Firewall with Advanced Security design. | | -| Based on the status of your current infrastructure, document your implementation goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. | | - -
- -**Next:** [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md deleted file mode 100644 index 8f0342581b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Implementing Your Windows Defender Firewall with Advanced Security Design Plan -description: Implementing Your Windows Defender Firewall with Advanced Security Design Plan -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Implementing Your Windows Defender Firewall with Advanced Security Design Plan - - -The following are important factors in the implementation of your Windows Defender Firewall design plan: - -- **Group Policy**. The Windows Defender Firewall with Advanced Security designs make extensive use of Group Policy deployed by Active Directory Domain Services (AD DS). A sound Group Policy infrastructure is required to successfully deploy the firewall and IPsec settings and rules to the devices on your network. - -- **Perimeter firewall**. Most organizations use a perimeter firewall to help protect the devices on the network from potentially malicious network traffic from outside of the organization's network boundaries. If you plan a deployment that includes a boundary zone to enable external devices to connect to devices in that zone, then you must allow that traffic through the perimeter firewall to the devices in the boundary zone. - -- **Devices running operating systems other than Windows**. If your network includes devices that aren't running the Windows operating system, then you must make sure that required communication with those devices isn't blocked by the restrictions put in place by your design. You must implement one of the following steps: - - - Include those devices in the isolated domain or zone by adding certificate-based authentication to your design. Many other operating systems can participate in an isolated domain or isolated server scenario, as long as certificate-based authentication is used. - - - Include the device in the authentication exemption list included in your design. You can choose this option if for any reason the device can't participate in the isolated domain design. - -## How to implement your Windows Defender Firewall with Advanced Security design using this guide - - -The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design. - -![wfas implementation.](images/wfas-implement.gif) - -Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Defender Firewall with Advanced Security design. - -- [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) - -- [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) - -- [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) - -- [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) - -The procedures in these checklists use the Group Policy MMC snap-in interfaces to configure firewall and connection security rules in GPOs, but you can also use Windows PowerShell. For more information, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). This guide recommends using GPOs in a specific way to deploy the rules and settings for your design. For information about deploying your GPOs, see [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) and the checklist [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md deleted file mode 100644 index bc7273b8b5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Isolated Domain GPOs -description: Learn about GPOs for isolated domains in this example configuration of Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Isolated Domain GPOs - - -All of the devices in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section. - -Each GPO has a security group filter that prevents the GPO from applying to members of the group GP\_DOMISO\_No\_IPsec. A WMI filter is attached to each GPO to ensure that the GPO is applied to only the specified version of Windows. For more information, see the [Planning GPO Deployment](planning-gpo-deployment.md) section. - -The GPOs created for the Woodgrove Bank isolated domain include: - -- [GPO\_DOMISO\_IsolatedDomain\_Clients](gpo-domiso-isolateddomain-clients.md) - -- [GPO\_DOMISO\_IsolatedDomain\_Servers](gpo-domiso-isolateddomain-servers.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md deleted file mode 100644 index 9925b88452..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Isolated Domain -description: Learn about the isolated domain, which is the primary zone for trusted devices, which use connection security and firewall rules to control communication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Isolated Domain - -**Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - -The isolated domain is the primary zone for trusted devices. The devices in this zone use connection security and firewall rules to control the communications that can be sent between devices in the zone. - -The term *domain* in this context means a boundary of communications trust instead of an Active Directory domain. In this solution, the two constructs are similar because Active Directory domain authentication (Kerberos V5) is required for accepting inbound connections from trusted devices. However, many Active Directory domains (or forests) can be linked with trust relationships to provide a single, logical, isolated domain. In addition, devices that authenticate by using certificates can also be included in an isolated domain without joining the Active Directory domain. - -For most implementations, an isolated domain will contain the largest number of devices. Other isolation zones can be created for the solution if their communication requirements differ from those requirements of the isolated domain. Examples of these differences are what result in the boundary and encryption zones described in this guide. Conceptually, the isolated domain is just the largest isolation zone, and a superset to the other zones. - -You must create a group in Active Directory to contain members of the isolated domain. You then apply one of several GPOs that contain connection security and firewall rules to the group so that authentication on all inbound network connections is enforced. Creation of the group and how to link the GPOs that apply the rules to its members are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -The GPOs for the isolated domain should contain the following connection security rules and settings. - -## GPO settings for isolated domain members running at least Windows Vista and Windows Server 2008 - - -GPOs for devices running at least Windows Vista and Windows Server 2008 should include: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. We recommend that you don't include DES, or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then also include user-based Kerberos V5 as an optional authentication method. Likewise, if any of your isolated domain members can't use Kerberos V5 authentication, then include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, where possible, instead of discrete addresses, if applicable in your environment. - - - A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication by using Kerberos V5 authentication. - - >**Important:**  Be sure to begin operations by using request in and request out behavior until you are sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the policy to require in, request out.  - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -**Next:** [Boundary Zone](boundary-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md deleted file mode 100644 index ca38900f59..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Link the GPO to the Domain -description: Learn how to link a GPO to the Active Directory container for the target devices, after you configure it in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Link the GPO to the Domain - - -After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target devices. - -If the filters comprehensively control the application of the GPO to only the correct devices, then you can link the GPO to the domain container. Alternatively, you can link the GPO to a site container or organizational unit if you want to limit application of the GPO to that subset of devices. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Admins group, or otherwise be delegated permissions to modify the GPOs. - -To link the GPO to the domain container in Active Directory - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, and then expand *YourDomainName*. - -3. Right-click *YourDomainName*, and then click **Link an Existing GPO**. - -4. In the **Select GPO** dialog box, select the GPO that you want to deploy, and then click **OK**. - -5. The GPO appears in the **Linked Group Policy Objects** tab in the details pane and as a linked item under the domain container in the navigation pane. - -6. You can adjust the order of the linked GPOs to ensure that the higher priority GPOs are processed last. Select a GPO and click the up or down arrows to move it. The GPOs are processed by the client device from the highest link order number to the lowest. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md deleted file mode 100644 index 438921b4cf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Mapping your implementation goals to a Windows Firewall with Advanced Security design -description: Mapping your implementation goals to a Windows Firewall with Advanced Security design -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Mapping your implementation goals to a Windows Firewall with Advanced Security design - - -After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. -> [!IMPORTANT] -> The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. - -Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security implementation goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security implementation goals to meet the needs of your organization. - -| Deployment Goals | Basic Firewall Policy Design | Domain Isolation Policy Design | Server Isolation Policy Design | Certificate-based Isolation Policy Design | -| - |- | - | - | - | -| [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)| Yes| Yes| Yes| Yes| -| [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) | -| Yes| Yes| Yes| -| [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)| -| -| Yes| Yes| -| [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)| -| Optional| Optional| Optional| - -To examine details for a specific design, click the design title at the top of the column in the preceding table. - -**Next:** [Basic Firewall Policy Design](basic-firewall-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md deleted file mode 100644 index 90d89139a8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Modify GPO Filters -description: Learn how to modify GPO filters to apply to a different zone or version of windows in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Modify GPO Filters to Apply to a Different Zone or Version of Windows - - -You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Change the security group filter for a GPO](#to-change-the-security-group-filter-for-a-gpo) - -- [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) - -- [Remove a block for members of a group from applying a GPO](#to-remove-a-block-for-members-of-group-from-applying-a-gpo) - -## To change the security group filter for a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, under **Security Filtering**, click the currently assigned security group, and then click **Remove**. - -4. Now you can add the appropriate security group to this GPO. Under **Security Filtering**, click **Add**. - -5. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -## To block members of a group from applying a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, click the **Delegation** tab. - -4. Click **Advanced**. - -5. Under the **Group or user names** list, click **Add**. - -6. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -7. Select the group in the **Group or user names** list, and then select the boxes in the **Deny** column for both **Read** and **Apply group policy**. - -8. Click **OK**, and then in the **Windows Security** dialog box, click **Yes**. - -9. The group appears in the list with custom permissions. - -## To remove a block for members of group from applying a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, click the **Delegation** tab. - -4. In the **Groups and users** list, select the group that should no longer be blocked, and then click **Remove**. - -5. In the message box, click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md deleted file mode 100644 index a9137e37d3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Open the Group Policy Management Console to IP Security Policies -description: Learn how to open the Group Policy Management Console to IP Security Policies to configure GPOs for earlier versions of the Windows operating system. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Open the Group Policy Management Console to IP Security Policies - - -Procedures in this guide that refer to GPOs for earlier versions of the Windows operating system instruct you to work with the IP Security Policy section in the Group Policy Management Console (GPMC). - -**To open a GPO to the IP Security Policies section** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, and then click **IP Security Policies on Active Directory (**YourDomainName**)**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md deleted file mode 100644 index 49aee564d3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Group Policy Management of Windows Firewall with Advanced Security -description: Group Policy Management of Windows Firewall with Advanced Security -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Group Policy Management of Windows Firewall with Advanced Security - - -Most of the procedures in this guide instruct you to use Group Policy settings for Windows Firewall with Advanced Security. - -To open a GPO to Windows Firewall with Advanced Security - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Management Editor, navigate to **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - LDAP://cn={**GUID**},cn=…**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md deleted file mode 100644 index 9ba7d78ace..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Group Policy Management of Windows Defender Firewall -description: Group Policy Management of Windows Defender Firewall with Advanced Security -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Group Policy Management of Windows Defender Firewall - - -To open a GPO to Windows Defender Firewall: - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Object Editor, navigate to **Computer Configuration** > **Administrative Templates** > **Network** > **Network Connections** > **Windows Defender Firewall**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md deleted file mode 100644 index 8440460338..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Open Windows Defender Firewall with Advanced Security -description: Learn how to open the Windows Defender Firewall with Advanced Security console. You must be a member of the Administrators group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Open Windows Defender Firewall with Advanced Security - - -This procedure shows you how to open the Windows Defender Firewall with Advanced Security console. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Administrators group. For more information, see Additional considerations. - -## To open Windows Defender Firewall using the UI - -Click Start, type **Windows Defender Firewall**, and then press ENTER. - -## To open Windows Defender Firewall from a command prompt - -1. Open a command prompt window. - -2. At the command prompt, type: - - ``` syntax - wf.msc - ``` - -**Additional considerations** - -Although standard users can start the Windows Defender Firewall MMC snap-in, to change most settings the user must be a member of a group with the permissions to modify those settings, such as Administrators. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md deleted file mode 100644 index da42f627c0..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Planning Certificate-based Authentication -description: Learn how a device unable to join an Active Directory domain can still participate in an isolated domain by using certificate-based authentication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Certificate-based Authentication - - -Sometimes a device can't join an Active Directory domain, and therefore can't use Kerberos V5 authentication with domain credentials. However, the device can still participate in the isolated domain by using certificate-based authentication. - -The non-domain member server, and the clients that must be able to communicate with it, must be configured to use cryptographic certificates based on the X.509 standard. These certificates can be used as an alternate set of credentials. During IKE negotiation, each device sends a copy of its certificate to the other device. Each device examines the received certificate, and then validates its authenticity. To be considered authentic, the received certificate must be validated by a certification authority certificate in the recipient's Trusted Root Certification Authorities store on the local device. - -Certificates can be acquired from commercial firms, or by an internal certificate server set up as part of the organization's public key infrastructure (PKI). Microsoft provides a complete PKI and certification authority solution with Windows Server 2012, Windows Server 2008 R2, and Windows Server 2008 Active Directory Certificate Services (AD CS). - -## Deploying certificates - -No matter how you acquire your certificates, you must deploy them to clients and servers that require them in order to communicate. - -### Using Active Directory Certificate Services - -If you use AD CS to create your own user and device certificates in-house, then the servers designated as certification authorities (CAs) create the certificates based on administrator-designed templates. AD CS then uses Group Policy to deploy the certificates to domain member devices. Device certificates are deployed when a domain member device starts. User certificates are deployed when a user logs on. - -If you want non-domain member devices to be part of a server isolation zone that requires access by only authorized users, make sure to include certificate mapping to associate the certificates with specific user accounts. When certificate mapping is enabled, the certificate issued to each device or user includes enough identification information to enable IPsec to match the certificate to both user and device accounts. - -AD CS automatically ensures that certificates issued by the CAs are trusted by the client devices by putting the CA certificates in the correct store on each domain member device. - -### Using a commercially purchased certificate for devices running Windows - -You can import the certificates manually onto each device if the number of devices is relatively small. For a deployment to more than a handful of devices, use Group Policy. - -You must first download the vendor's root CA certificate, and then import it to a GPO that deploys it to the Local Computer\\Trusted Root Certification Authorities store on each device that applies the GPO. - -You must also import the purchased certificate into a GPO that deploys it to the Local Computer\\Personal store on each device that applies the GPO. - -### Using a commercially purchased certificate for devices running a non-Windows operating system - -If you're installing the certificates on an operating system other than Windows, see the documentation for that operating system. - -## Configuring IPsec to use the certificates - -When the clients and servers have the certificates available, you can configure the IPsec and connection security rules to include those certificates as a valid authentication method. The authentication method requires the subject name of the certificate, for example: **DC=com,DC=woodgrovebank,CN=CorporateCertServer**. Optionally, select **Enable certificate to account mapping** to support using these credentials for restricting access to users or devices that are members of authorized groups in a server isolation solution. - -Starting in Windows Server 2012, you can configure certificate selection criteria so the desired certificate is selected and/or validated. extended key usage (EKU) criteria can be configured, and name restrictions and certificate thumbprints. This EKU is configured using the **Advanced** button when choosing certificates for the authentication method in the user interface, or through Windows PowerShell. - -**Next:** [Documenting the Zones](documenting-the-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md deleted file mode 100644 index 70214d68c5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Planning Domain Isolation Zones -description: Learn how to use information you've gathered to make decisions about isolation zones for your environment in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Domain Isolation Zones - - -After you have the required information about your network, Active Directory, and client and server devices, you can use that information to make decisions about the isolation zones you want to use in your environment. - -The bulk of the work in planning server and domain isolation is determining which devices to assign to each isolation zone. Correctly choosing the zone for each device is important to providing the correct level of security without compromising performance or the ability for a device to send or receive required network traffic. - -The zones described in this guide include: - -- [Exemption List](exemption-list.md) - -- [Isolated Domain](isolated-domain.md) - -- [Boundary Zone](boundary-zone.md) - -- [Encryption Zone](encryption-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md deleted file mode 100644 index 0370e8cb08..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Planning GPO Deployment -description: Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning GPO Deployment - - -You can control which GPOs are applied to devices in Active Directory in a combination of three ways: - -- **Active Directory organizational unit hierarchy**. This method involves linking the GPO to a specific OU in the Active Directory OU hierarchy. All devices in the OU and its subordinate containers receive and apply the GPO. - - Controlling GPO application through linking to OUs is typically used when you can organize the OU hierarchy according to your domain isolation zone requirements. GPOs can apply settings to devices based on their location within Active Directory. If a device is moved from one OU to another, the policy linked to the second OU will eventually take effect when Group Policy detects the change during polling. - -- **Security group filtering**. This method involves linking the GPOs to the domain level (or other parent OU) in the OU hierarchy, and then selecting which devices receive the GPO by using permissions that only allow correct group members to apply the GPO. - - The security group filters are attached to the GPOs themselves. A group is added to the security group filter of the GPO in Active Directory, and then assigned Read and Apply Group Policy permissions. Other groups can be explicitly denied Read and Apply Group Policy permissions. Only those devices whose group membership are granted Read and Apply Group Policy permissions without any explicit deny permissions can apply the GPO. - -- **WMI filtering**. A WMI filter is a query that is run dynamically when the GPO is evaluated. If a device is a member of the result set when the WMI filter query runs, the GPO is applied to the device. - - A WMI filter consists of one or more conditions that are evaluated against the local device. You can check almost any characteristic of the device, its operating system, and its installed programs. If all of the specified conditions are true for the device, the GPO is applied; otherwise the GPO is ignored. - -This guide uses a combination of security group filtering and WMI filtering to provide the most flexible options. If you follow this guidance, even though there might be five different GPOs linked to a specific group because of operating system version differences, only the correct GPO is applied. - -## General considerations - -- Deploy your GPOs before you add any device accounts to the groups that receive the GPOs. That way you can add your devices to the groups in a controlled manner. Be sure to add only a few test devices at first. Before adding many group members, examine the results on the test devices and verify that the configured firewall and connection security rules have the effect that you want. See the following sections for some suggestions on what to test before you continue. - -## Test your deployed groups and GPOs - -After you've deployed your GPOs and added some test devices to the groups, confirm the following before you continue with more group members: - -- Examine the GPOs that are both assigned to and filtered from the device. Run the **gpresult** tool at a command prompt. - -- Examine the rules deployed to the device. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, and then expand the **Firewall** and **Connection Security** nodes. - -- Verify that communications are authenticated. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, expand the **Security Associations** node, and then click **Main Mode**. - -- Verify that communications are encrypted when the devices require it. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, expand the **Security Associations** node, and then select **Quick Mode**. Encrypted connections display a value other than **None** in the **ESP Confidentiality** column. - -- Verify that your programs are unaffected. Run them and confirm that they still work as expected. - -After you've confirmed that the GPOs have been correctly applied, and that the devices are now communicating by using IPsec network traffic in request mode, you can begin to add more devices to the group accounts, in manageable numbers at a time. Continue to monitor and confirm the correct application of the GPOs to the devices. - -## Don't enable require mode until deployment is complete - -If you deploy a GPO that requires authentication to a device before the other devices have a GPO deployed, communication between them might not be possible. Wait until you have all the zones and their GPOs deployed in request mode and confirm (as described in the previous section) that the devices are successfully communicating by using IPsec. - -If there are problems with GPO deployment, or errors in configuration of one or more of the IPsec GPOs, devices can continue to operate, because request mode enables any device to fall back to clear communications. - -Only after you've added all of the devices to their zones, and you've confirmed that communications are working as expected, you can start changing the request mode rules to require mode rules where it's required in the zones. We recommend that you enable require mode in the zones one zone at a time, pausing to confirm that they're functioning properly before you continue. Turn the required mode setting on for the server isolation zones first, then the encryption zone, and then the isolated domain. - -Don't change the boundary zone GPO, because it must stay in request mode for both inbound and outbound connections. - -If you create other zones that require either inbound or outbound require mode, make the setting change in a manner that applies the setting in stages from the smaller groups of devices to the larger groups. - -## Example Woodgrove Bank deployment plans - -Woodgrove Bank links all its GPOs to the domain level container in the Active Directory OU hierarchy. It then uses the following WMI filters and security group filters to control the application of the GPOs to the correct subset of devices. All of the GPOs have the User Configuration section disabled to improve performance. - -### GPO\_DOMISO\_Firewall - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType <> "2"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_IsolatedDomain\_Clients - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "1"` - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_IsolatedDomain\_Servers - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_Boundary - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_Boundary. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_Encryption - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply permissions in Group Policy only to devices that are members of the group CG\_DOMISO\_Encryption. The GPO also explicitly denies Read and Apply permissions in Group Policy to members of the group CG\_DOMISO\_NO\_IPSEC. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md deleted file mode 100644 index 2dc15edfc9..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Planning Group Policy Deployment for Your Isolation Zones -description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design for your isolation environment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Group Policy Deployment for Your Isolation Zones - - -After you've decided on the best logical design of your isolation environment for the network and device security requirements, you can start the implementation plan. - -You have a list of isolation zones with the security requirements of each. For implementation, you must plan the groups that will hold the device accounts in each zone, the network access groups that will be used to determine who can access an isolated server, and the GPOs with the connection security and firewall rules to apply to corresponding groups. Finally you must determine how you'll ensure that the policies will only apply to the correct devices within each group. - -- [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) - -- [Planning Network Access Groups](planning-network-access-groups.md) - -- [Planning the GPOs](planning-the-gpos.md) - -- [Planning GPO Deployment](planning-gpo-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md deleted file mode 100644 index b58bf3b769..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Planning Isolation Groups for the Zones -description: Learn about planning isolation groups for the zones in Microsoft Firewall, including information on universal groups and GPOs. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Isolation Groups for the Zones - - -Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group that represents that zone. - -> [!CAUTION] -> Do not add devices to your groups yet. If a device is in a group when the GPO is activated then that GPO is applied to the device. If the GPO is one that requires authentication, and the other devices have not yet received their GPOs, the device that uses the new GPO might not be able to communicate with the others. - -Universal groups are the best option to use for GPO assignment because they apply to the whole forest and reduce the number of groups that must be managed. However, if universal groups are unavailable, you can use domain global groups instead. - -The following table lists typical groups that can be used to manage the domain isolation zones discussed in the Woodgrove Bank example in this guide: - -| Group name | Description | -| - | - | -| CG_DOMISO_No_IPsec | A universal group of device accounts that don't participate in the IPsec environment. Typically consists of infrastructure device accounts that will also be included in exemption lists.
This group is used in security group filters to ensure that GPOs with IPsec rules aren't applied to group members.| -| CG_DOMISO_IsolatedDomain | A universal group of device accounts that contains the members of the isolated domain.
During the early days of testing, this group might contain only a small number of devices. During production, it might contain the built-in **Domain Computers** group to ensure that every device in the domain participates.
Members of this group receive the domain isolation GPO that requires authentication for inbound connections.| -| CG_DOMISO_Boundary | A universal group of device accounts that contains the members of the boundary zone.

Members of this group receive a GPO that specifies that authentication is requested, but not required.| -| CG_DOMISO_Encryption | A universal group of device accounts that contains the members of the encryption zone.
Members of this group receive a GPO that specifies that both authentication and encryption are required for all inbound connections. -| CG_SRVISO_*ServerRole* | A universal group of device accounts that contains the members of the server isolation group.
Members of this group receive the server isolation GPO that requires membership in a network access group in order to connect.
There will be one group for each set of servers that have different user and device restriction requirements. | - -Multiple GPOs might be delivered to each group. Which one actually becomes applied depends on the security group filters assigned to the GPOs in addition to the results of any WMI filtering assigned to the GPOs. Details of the GPO layout are discussed in the section [Planning the GPOs](planning-the-gpos.md). - -If multiple GPOs are assigned to a group, and similar rules are applied, the rule that most specifically matches the network traffic is the one that is used by the device. For example, if one IPsec rule says to request authentication for all IP traffic, and a second rule from a different GPO says to require authentication for IP traffic to and from a specific IP address, then the second rule takes precedence because it's more specific. - -**Next:** [Planning Network Access Groups](planning-network-access-groups.md) - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md deleted file mode 100644 index 436bc55bbd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Planning Network Access Groups -description: Learn how to implement a network access group for users and devices that can access an isolated server in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Network Access Groups - - -A network access group (NAG) is used to identify users and devices that have permission to access an isolated server. The server is configured with firewall rules that allow only network connections that are authenticated as originating from a device, and optionally a user, whose accounts are members of its NAG. A member of the isolated domain can belong to as many NAGs as required. - -Minimize the number of NAGs to limit the complexity of the solution. You need one NAG for each server isolation group to restrict the devices or users that are granted access. You can optionally split the NAG into two different groups: one for authorized devices and one for authorized users. - -The NAGs that you create and populate become active by referencing them in the **Users and Computers** tab of the firewall rules in the GPO assigned to the isolated servers. The GPO must also contain connection security rules that require authentication to supply the credentials checked for NAG membership. - -For the Woodgrove Bank scenario, access to the devices running SQL Server which support the WGBank application are restricted to the WGBank front-end servers and to approved administrative users logged on to specific authorized administrative devices. They're also only accessed by the approved admin users and the service account that is used to the run the WGBank front end service. - -| NAG Name | NAG Member Users, Computers, or Groups | Description | -| - | - | - | -| CG_NAG_*ServerRole*_Users| Svr1AdminA
Svr1AdminB
Group_AppUsers
AppSvcAccount| This group is for all users who are authorized to make inbound IPsec connections to the isolated servers in this zone.| -| CG_NAG_*ServerRole*_Computers| Desktop1
Desktop2
AdminDT1
AppAdminDT1| This group contains all devices that are authorized to make inbound IPsec connections to the isolated servers in this zone.| - ->**Note:**  Membership in a NAG does not control the level of IPsec traffic protection. The IKE negotiation is only aware of whether the device or user passed or failed the Kerberos V5 authentication process. The connection security rules in the applied GPO control the security methods that are used for protecting traffic and are independent of the identity being authenticated by Kerberos V5. - -**Next:** [Planning the GPOs](planning-the-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md deleted file mode 100644 index c729611dac..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Planning Server Isolation Zones -description: Learn how to restrict access to a server to approved users by using a server isolation zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Server Isolation Zones - - -Sometimes a server hosts data that is sensitive. If your servers host data that must not be compromised, you have several options to help protect that data. One was already addressed: adding the server to the encryption zone. Membership in that zone prevents the server from being accessed by any devices that are outside the isolated domain, and encrypts all network connections to server. - -The second option is to additionally restrict access to the server, not just to members of the isolated domain, but to only those users or devices who have business reasons to access the resources on the server. You can specify only approved users, or you can additionally specify that the approved users can only access the server from approved devices. - -To grant access, you add the approved user and device accounts to network access groups (NAGs) that are referenced in a firewall rule on this server. When the user sends a request to the server, the standard domain isolation rules are invoked. This invocation causes IKE to use Kerberos V5 to exchange credentials with the server. The other firewall rule on the server causes Windows to check the provided device and user accounts for group membership in the NAGs. If either the user or device isn't a member of a required NAG, then the network connection is refused. - -## Isolated domains and isolated servers - -If you're using an isolated domain, the client devices already have the IPsec rules to enable them to authenticate traffic when the server requires it. If you add an isolated server, it must have a GPO applied to its group with the appropriate connection security and firewall rules. The rules enforce authentication and restrict access to only connections that are authenticated as coming from an authorized device or user. - -If you aren't using an isolated domain, but still want to isolate a server that uses IPsec, you must configure the client devices that you want to access the server to use the appropriate IPsec rules. If the client devices are members of an Active Directory domain, you can still use Group Policy to configure the clients. Instead of applying the GPO to the whole domain, you apply the GPO to only members of the NAG. - -## Creating multiple isolated server zones - -Each set of servers that must be accessed by different sets of users should be set up in its own isolated server zone. After one set of GPOs for one isolated server zone has been successfully created and verified, you can copy the GPOs to a new set. You must change the GPO names to reflect the new zone, the name and membership of the isolated server zone group to which the GPOs are applied, and the names and membership of the NAG groups that determine which clients can access the servers in the isolated server zone. - -## Creating the GPOs - -Creation of the groups and how to link them to the GPOs that apply the rules to members of the groups are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -An isolated server is often a member of the encryption zone. Therefore, copying that GPO set serves as a good starting point. You then modify the rules to additionally restrict access to only NAG members. - -### GPO settings for isolated servers running at least Windows Server 2008 - -GPOs for devices running at least Windows Server 2008 should include: - ->**Note:**  The connection security rules described here are identical to the ones for the encryption zone. If you do not want to encrypt access and also restrict access to NAG members, you can use connection security rules identical to the main isolated domain. You must still add the firewall rule described at the end of this list to change it into an isolated server zone. - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you don't include Diffie-Hellman Group 1, DES, or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. Check **Require encryption for all connection security rules that use these settings**, and then specify one or more integrity and encryption combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, don't use AH because it can't traverse NAT devices. If isolated servers must communicate with hosts in the encryption zone, include an algorithm that is compatible with the requirements of the encryption zone GPOs. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication for compatibility with the rest of the isolated domain. If you want to restrict access to specific user accounts, also include user-based Kerberos V5 authentication as an optional authentication method. Don't make the user-based authentication method mandatory, or else devices that can't use AuthIP instead of IKE, including Windows XP and Windows Server 2003, can't communicate. Likewise, if any of your domain isolation members can't use Kerberos V5, include certificate-based authentication as an optional authentication method. - -- The following connection security and firewall rules: -s - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from **Any IP address** to **Any IP address**, that requires inbound and requests outbound authentication by using Kerberos V5 authentication. - - >**Important:**  Be sure to begin operations by using request in and request out behavior until you are sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the GPO to require in, request out. - - - A firewall rule that specifies **Allow only secure connections**, **Require encryption**, and on the **Users and Computers** tab includes references to both device and user network access groups. - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -**Next:** [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md deleted file mode 100644 index 98e6a224a8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Planning Settings for a Basic Firewall Policy -description: Learn how to design a basic policy for Windows Defender Firewall with Advanced Security, the settings and rules that enforce your requirements on devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Settings for a Basic Firewall Policy - - -After you've identified your requirements, and have the information about the network layout and devices available, you can begin to design the GPO settings and rules that will enable you to enforce your requirements on the devices. - -The following list is that of the firewall settings that you might consider for inclusion in a basic firewall design, together with recommendations to serve as a starting point for your analysis: - -- **Profile selection**. The firewall rules can be configured for any of the network location profiles that you see in the Network and Sharing Center: **Domain**, **Public**, and **Private**. Most settings are enforced in the Domain profile, without an option for the user to change them. However, you might want to leave the profile settings configurable by the user on devices that can be taken from the organization's physical network and joined to a public or home network. If you lock down the public and private profiles, you might prevent a user from accessing a required network program or service. Because they aren't on the organization's network, you can't fix a connectivity problem by deploying rule changes in a GPO. For each section that follows, consider each profile and apply the rules to those profiles that make sense for your organization. - - >**Important:**  We recommend that on server devices that you set all rules for all profiles to prevent any unexpected profile switch from disrupting network connectivity. You might consider a similar practice for your desktop devices, and only support different profiles on portable devices. - -- **Firewall state: On**. We recommend that you prevent the user from turning it off. - -- **Default behavior for Inbound connections: Block**. We recommend that you enforce the default behavior of blocking unsolicited inbound connections. To allow network traffic for a specific program, create an inbound rule that serves as an exception to this default behavior. - -- **Default behavior for Outbound connections: Allow**. We recommend that you enforce the default behavior of allowing outbound connections. - -- **Allow unicast response: Yes**. We recommend that you use the default setting of **Yes** unless you have specific requirements to do otherwise. - -- **Apply local firewall rules: Yes**. We recommend that you allow users to create and use local firewall rules. If you set this setting to **No**, then when a user clicks **Allow** on the notification message to allow traffic for a new program, Windows doesn't create a new firewall rule and the traffic remains blocked. - - If you and the IT staff can create and maintain the list of firewall rules for all permitted applications and deploy them by using GPOs, then you can set this value to **No**. - -- **Apply local connection security rules: No**. We recommend that you prevent users from creating and using their own connection security rules. Connection failures caused by conflicting rules can be difficult to troubleshoot. - -- **Logging**. We recommend that you enable logging to a file on the local hard disk. Be sure to limit the size, such as 4096 KB, to avoid causing performance problems by filling the user's hard disk. Be sure to specify a folder to which the Windows Defender Firewall with Advanced Security service account has write permissions. - -- **Inbound rules**. Create inbound rules for programs that must be able to receive unsolicited inbound network packets from another device on the network. Make the rules as specific as possible to reduce the risk of malicious programs exploiting the rules. For example, specify both program and port numbers. Specifying a program ensures that the rule is only active when the program is actually running, and specifying the port number ensures that the program can't receive unexpected traffic on a different port. - - Inbound rules are common on servers, because they host services to which client devices connect. When you install programs and services on a server, the installation program typically creates and enables the rules for you. Examine the rules to ensure that they don't open up more ports than are required. - - >**Important:**  If you create inbound rules that permit RPC network traffic by using the **RPC Endpoint Mapper** and **Dynamic RPC** rule options, then all inbound RPC network traffic is permitted because the firewall cannot filter network traffic based on the UUID of the destination application. - -- **Outbound rules**. Only create outbound rules to block network traffic that must be prevented in all cases. If your organization prohibits the use of certain network programs, you can support that policy by blocking the known network traffic used by the program. Be sure to test the restrictions before you deploy them to avoid interfering with traffic for needed and authorized programs. - -**Next:** [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md deleted file mode 100644 index 88716eaf2a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Planning the GPOs -description: Learn about planning Group Policy Objects for your isolation zones in Windows Defender Firewall with Advanced Security, after you design the zone layout. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning the GPOs - - -When you plan the GPOs for your different isolation zones, you must complete the layout of the required zones and their mappings to the groups that link the devices to the zones. - -## General considerations - -A few things to consider as you plan the GPOs: - -- Don't allow a device to be a member of more than one isolation zone. A device in more than one zone receives multiple and possibly contradictory GPOs. This receipt of multiple GPOs can result in unexpected, and difficult to troubleshoot behavior. - - The examples in this guide show GPOs that are designed to prevent the requirement to belong to multiple zones. - -- Ensure that the IPsec algorithms you specify in your GPOs are compatible across all the versions of Windows. The same principle applies to the data integrity and encryption algorithms. We recommend that you include the more advanced algorithms when you have the option of selecting several in an ordered list. The devices will negotiate down from the top of their lists, selecting one that is configured on both devices. - -- The primary difference in your domain isolation GPOs is whether the rules request or require authentication. - - >**Caution:**  It is **critical** that you begin with all your GPOs set to request authentication instead of requiring it. Since the GPOs are delivered to the devices over time, applying a require policy to one device breaks its ability to communicate with another device that has not yet received its policy. Using request mode at the beginning enables devices to continue communicating by using plaintext connections if required. After you confirm that your devices are using IPsec where expected, you can schedule a conversion of the rules in the GPOs from requesting to requiring authentication, as required by each zone. - -- Windows Defender Firewall* in Windows Vista and Windows Server 2008 only support one network location profile at a time. If you add a second network adapter that is connected to a different network, or not connected at all, you could unintentionally change the profile that is currently active on the device. If your GPO specifies different firewall and connection security rules based on the current network location profile, the behavior of how the device handles network traffic will change accordingly. We recommend for stationary devices, such as desktops and servers, that you assign any rule for the device to all profiles. Apply GPOs that change rules per network location to devices that must move between networks, such as your portable devices. Consider creating a separate domain isolation GPO for your servers that uses the same settings as the GPO for the clients, except that the server GPO specifies the same rules for all network location profiles. - -*Windows Defender Firewall is now called Windows Defender Firewall with Advanced Security in Windows 10 and Windows 11. - - > [!NOTE] - > Devices running Windows 7, Windows Server 2008 R2, and later support different network location types, and therefore profiles, for each network adapter at the same time. Each network adapter is assigned the network location appropriate for the network to which it is connected. Windows Defender Firewall then enforces only those rules that apply to that network type’s profile. So certain types of traffic are blocked when coming from a network adapter connected to a public network, but those same types might be permitted when coming from a private or domain network. - -After you consider these issues, document each GPO that you require, and the details about the connection security and firewall rules that it needs. - -## Woodgrove Bank example GPOs - -The Woodgrove Bank example uses the following set of GPOs to support its domain isolation requirements. This section only discusses the rules and settings for server and domain isolation. GPO settings that affect which devices receive the GPO, such as security group filtering and WMI filtering, are discussed in the [Planning GPO Deployment](planning-gpo-deployment.md) section. - -In this section you can find information about: - -- [Firewall GPOs](firewall-gpos.md) - -- [Isolated Domain GPOs](isolated-domain-gpos.md) - -- [Boundary Zone GPOs](boundary-zone-gpos.md) - -- [Encryption Zone GPOs](encryption-zone-gpos.md) - -- [Server Isolation GPOs](server-isolation-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md deleted file mode 100644 index 7e7bff476d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Plan to Deploy Windows Defender Firewall with Advanced Security -description: Use the design information in this article to plan for the deployment of Windows Defender Firewall with Advanced Security in your organization. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning to Deploy Windows Defender Firewall with Advanced Security - - -After you collect information about your environment and decide on a design by following the guidance in the [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md), you can begin to plan the deployment of your design. With the completed design and the information in this topic, you can determine which tasks to perform to deploy Windows Defender Firewall with Advanced Security in your organization. - -## Reviewing your Windows Defender Firewall with Advanced Security Design - -If the design team that created the Windows Defender Firewall design for your organization is different from the deployment team that will implement it, make sure the deployment team reviews the final design with the design team. Review the following information before starting your deployment. - -### Decide which devices apply to which GPO - -The design team's strategy for determining how WMI and security group filters attached to the GPOs will determine which devices apply to which GPO. The deployment team can refer to the following topics in the Windows Defender Firewall with Advanced Security Design Guide: - -- [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) - -- [Planning the GPOs](planning-the-gpos.md) - -- [Planning GPO Deployment](planning-gpo-deployment.md) - -### Configure communication between members and devices - -Decide what communication is to be allowed between members of each of the zones in the isolated domain and devices that aren't part of the isolated domain or members of the isolated domain's exemption list. - -### Exempt domain controllers from IPsec authentication requirements - -It's recommended that domain controllers are exempt from IPsec authentication requirements. If they aren't exempt and authentication fails, then domain clients might not be able to receive Group Policy updates to the IPsec connection security rules from the domain controllers. - -### Configure IPsec authentication rules - -The rationale for configuring all IPsec authentication rules to request, not require, authentication until the successful negotiation of IPsec has been confirmed. If the rules are set to require authentication before confirming that authentication is working correctly, then communications between devices might fail. If the rules are set to request authentication only, then an IPsec authentication failure results in fall-back-to-clear behavior. Communications can continue while the authentication failures are investigated. - -### Make sure all devices can communicate with each other - -For all devices to communicate with each other, they must share a common set of: - -- Authentication methods - -- Main mode key exchange algorithms - -- Quick mode data integrity algorithms - -If at least one set of each doesn't match between two devices, then the devices can't successfully communicate. - -## Deploy your Windows Firewall Design Plan - -After the design and deployment teams agree on these issues, they can proceed with the deployment of the Windows Defender Firewall design. For more information, see [Implementing Your Windows Defender Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md deleted file mode 100644 index e048764374..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Planning Your Windows Defender Firewall with Advanced Security Design -description: After you gather the relevant information, select the design or combination of designs for Windows Defender Firewall with Advanced Security in your environment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Your Windows Defender Firewall with Advanced Security Design - - -After you've gathered the relevant information in the previous sections, and understood the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. - -## Basic firewall design - -We recommend that you deploy at least the basic firewall design. As discussed in the [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) section, host-based firewalls are an important element in a defense-in-depth strategy and complement most other security measures you put in place in your organization. - -When you're ready to examine the options for firewall policy settings, see the [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) section. - -## Algorithm and method support and selection - -To create a domain isolation or server isolation design, you must understand the algorithms available in each version of Windows, and their relative strengths. - -## IPsec performance considerations - -Although IPsec is critically important in securing network traffic going to and from your devices, there are costs associated with its use. The mathematically intensive cryptographic algorithms require a significant amount of computing power, which can prevent your device from making use of all of the available bandwidth. For example, an IPsec-enabled device using the AES encryption protocols on a 10 gigabits per second (Gbps) network link might see a throughput of 4.5 Gbps. This reduction is due to the demands placed on the CPU to perform the cryptographic functions required by the IPsec integrity and encryption algorithms. - -IPsec task offload is a Windows technology that supports network adapters equipped with dedicated cryptographic processors to perform the computationally intensive work required by IPsec. This configuration frees up a device’s CPU and can dramatically increase network throughput. For the same network link as above, the throughput with IPsec task offload enabled improves to about 9.2 Gbps. - -## Domain isolation design - - -Include this design in your plans: - -- If you have an Active Directory domain of which most of the devices are members. - -- If you want to prevent the devices in your organization from accepting any unsolicited network traffic from devices that aren't part of the domain. - -If you plan on including the basic firewall design as part of your deployment, we recommend that you deploy the firewall policies first to confirm that they work properly. Also plan to enable your connection security rules in request mode at first, instead of the more restrictive require mode, until you're sure that the devices are all correctly protecting network traffic with IPsec. If something is wrong, request mode still allows communications to continue while you're troubleshooting. - -When you're ready to examine the options for creating an isolated domain, see the [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) section. - -## Server isolation design - - -Include this design in your plans: - -- If you have an isolated domain and you want to additionally restrict access to specific servers to only authorized users and devices. - -- You aren't deploying an isolated domain, but want to take advantage of similar benefits for a few specific servers. You can restrict access to the isolated servers to only authorized users and devices. - -If you plan to include domain isolation in your deployment, we recommend that you complete that layer and confirm its correct operation before you implement the other server isolation elements. - -When you're ready to examine the options for isolating servers, see the [Planning Server Isolation Zones](planning-server-isolation-zones.md) section. - -## Certificate-based authentication design - - -Include this design in your plans: - -- If you want to implement some of the elements of domain or server isolation on devices that aren't joined to an Active Directory domain, or don't want to use domain membership as an authentication mechanism. - -- You have an isolated domain and want to include a server that isn't a member of the Active Directory domain because the device isn't running Windows, or for any other reason. - -- You must enable external devices that aren't managed by your organization to access information on one of your servers in a secure way. - -If you plan to include domain or server isolation in your deployment, we recommend that you complete those elements and confirm their correct operation before you add certificate-based authentication to the devices that require it. - -When you're ready to examine the options for using certificate-based authentication, see the [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) section. - -## Documenting your design - -After you finish selecting the designs that you'll use, you must assign each of your devices to the appropriate isolation zone and document the assignment for use by the deployment team. - -- [Documenting the Zones](documenting-the-zones.md) - -## Designing groups and GPOs - - -After you've selected a design and assigned your devices to zones, you can begin laying out the isolation groups for each zone, the network access groups for isolated server access, and the GPOs that you'll use to apply the settings and rules to your devices. - -When you're ready to examine the options for the groups, filters, and GPOs, see the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -**Next:** [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md deleted file mode 100644 index ee0412021e..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Protect devices from unwanted network traffic -description: Learn how running a host-based firewall on every device in your organization can help protect against attacks as part of a defense-in-depth security strategy. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 01/18/2022 ---- - -# Protect devices from unwanted network traffic - - -Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall can't protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable devices are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats. - -Reports of targeted attacks against organizations, governments, and individuals have become more widespread in recent years. For a general overview of these threats, also known as advanced persistent threats (APT), see the [Microsoft Security Intelligence Report](https://www.microsoft.com/security/business/security-intelligence-report). - -Running a host-based firewall on every device that your organization manages is an important layer in a "defense-in-depth" security strategy. A host-based firewall can help protect against attacks that originate from inside the network and also provide extra protection against attacks from outside the network that manage to penetrate the perimeter firewall. It also travels with a portable device to provide protection when it's away from the organization's network. - -A host-based firewall helps secure a device by dropping all network traffic that doesn't match the administrator-designed rule set for permitted network traffic. This design, which corresponds to [Basic Firewall Policy Design](basic-firewall-policy-design.md), provides the following benefits: - -- Network traffic that is a reply to a request from the local device is permitted into the device from the network. - -- Network traffic that is unsolicited, but that matches a rule for allowed network traffic, is permitted into the device from the network. - - For example, Woodgrove Bank wants a device that is running SQL Server to be able to receive the SQL queries sent to it by client devices. The firewall policy deployed to the device that is running SQL Server includes firewall rules that specifically allow inbound network traffic for the SQL Server program. - -- Outbound network traffic that isn't blocked is allowed on the network. - - For example, Woodgrove Bank has a corporate policy that prohibits the use of certain peer-to-peer file sharing programs. The firewall policy deployed to the computers on the network includes firewall rules that block both inbound and outbound network traffic for the prohibited programs. All other outbound traffic is permitted. - -The following component is recommended for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more Group Policy objects (GPOs) that can be automatically applied to all relevant computers in the domain. - -Other means of deploying a firewall policy are available, such as creating scripts that use the netsh command-line tool, and then running those scripts on each computer in the organization. This guide uses Active Directory as a recommended means of deployment because of its ability to scale to large organizations. - -**Next:** [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md deleted file mode 100644 index 1070cb1a65..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Require Encryption When Accessing Sensitive Network Resources -description: Windows Defender Firewall with Advanced Security allows you to require that all network traffic in an isolated domain be encrypted. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Require Encryption When Accessing Sensitive Network Resources - - -The use of authentication in the previously described goal ([Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) enables a device in the isolated domain to block traffic from untrusted devices. However, it doesn't prevent an untrusted device from eavesdropping on the network traffic shared between two trusted devices, because by default network packets aren't encrypted. - -For devices that share sensitive information over the network, Windows Defender Firewall with Advanced Security allows you to require that all such network traffic be encrypted. Using encryption can help you comply with regulatory and legislative requirements such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. By creating connection security rules that apply to devices that host and exchange sensitive data, you can help protect the confidentiality of that data by encrypting it. - -The following illustration shows an encryption zone in an isolated domain. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. - -![encryption zone in an isolated domain.](images/wfas-domainisoencrypt.gif) - -This goal provides the following benefits: - -- Devices in the encryption zone require authentication to communicate with other devices. This rule works no differently from the domain isolation goal and design. For more information, see [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md). - -- Devices in the encryption zone require that all inbound and outbound network traffic be encrypted. - - For example, Woodgrove Bank processes sensitive customer data on a device that must be protected from eavesdropping by devices on the network. Connection security rules specify that all traffic must be encrypted by a sufficiently complex encryption algorithm to help protect the data. - -- Devices in the encryption zone are often good candidates for server isolation, where access is limited to only computer accounts and user accounts that are members of an authorized access group. In many organizations, the encryption zone and the server isolation zone are one and the same. For more info, see [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md). - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md deleted file mode 100644 index 28c8049c79..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Restrict Access to Only Specified Users or Devices -description: Restrict access to devices and users that are members of domain groups authorized to access that device using Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict Access to Only Specified Users or Computers - - -Domain isolation (as described in the previous goal [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) prevents devices that are members of the isolated domain from accepting network traffic from untrusted devices. However, some devices on the network might host sensitive data that must be additionally restricted to only those users and computers that have a business requirement to access the data. - -Windows Defender Firewall with Advanced Security enables you to restrict access to devices and users that are members of domain groups authorized to access that device. These groups are called *network access groups (NAGs)*. When a device authenticates to a server, the server checks the group membership of the computer account and the user account, and grants access only if membership in the NAG is confirmed. Adding this check creates a virtual "secure zone" within the domain isolation zone. You can have multiple devices in a single secure zone, and it's likely that you'll create a separate zone for each set of servers that have specific security access needs. Devices that are part of this server isolation zone are often also part of the encryption zone (see [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)). - -Restricting access to only users and devices that have a business requirement can help you comply with regulatory and legislative requirements, such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. - -You can restrict access by specifying either computer or user credentials. - -The following illustration shows an isolated server, and examples of devices that can and can't communicate with it. Devices that are outside the Woodgrove corporate network, or computers that are in the isolated domain but aren't members of the required NAG, can't communicate with the isolated server. - -![isolated domain with network access groups.](images/wfas-domainnag.gif) - -This goal, which corresponds to [Server Isolation Policy Design](server-isolation-policy-design.md), provides the following features: - -- Isolated servers accept unsolicited inbound network traffic only from devices or users that are members of the NAG. - -- Isolated servers can be implemented as part of an isolated domain, and treated as another zone. Members of the zone group receive a GPO with rules that require authentication, and that specify that only network traffic authenticated as coming from a member of the NAG is allowed. - -- Server isolation can also be configured independently of an isolated domain. To do so, configure only the devices that must communicate with the isolated server with connection security rules to implement authentication and check NAG membership. - -- A server isolation zone can be simultaneously configured as an encryption zone. To do so, configure the GPO with rules that force encryption in addition to requiring authentication and restricting access to NAG members. For more information, see [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md deleted file mode 100644 index f02e9c5708..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Restrict access to only trusted devices -description: Windows Defender Firewall with Advanced Security enables you to isolate devices you trust and restrict access of untrusted devices to trusted devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict access to only trusted devices - - -Your organizational network likely has a connection to the Internet. You also likely have partners, vendors, or contractors who attach devices that aren't owned by your organization to your network. Because you don't manage those devices, you can't trust them to be free of malicious software, maintained with the latest security updates, or in any way in compliance with your organization's security policies. These untrustworthy devices both on and outside of your physical network must not be permitted to access your organization's devices except where it's truly required. - -To mitigate this risk, you must be able to isolate the devices you trust, and restrict their ability to receive unsolicited network traffic from untrusted devices. By using connection security and firewall rules available in Windows Defender Firewall with Advanced Security, you can logically isolate the devices that you trust by requiring that all unsolicited inbound network traffic be authenticated. Authentication ensures that each device or user can positively identify itself by using credentials that are trusted by the other device. Connection security rules can be configured to use IPsec with the Kerberos V5 protocol available in Active Directory, or certificates issued by a trusted certification authority as the authentication method. - -> [!NOTE] -> Because the primary authentication method recommended for devices that are running Windows is to use the Kerberos V5 protocol with membership in an Active Directory domain, this guide refers to this logical separation of computers as *domain isolation*, even when certificates are used to extend the protection to devices that are not part of an Active Directory domain. - -The protection provided by domain isolation can help you comply with regulatory and legislative requirements, such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. - -The following illustration shows an isolated domain, with one of the zones that are optionally part of the design. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. - -![domain isolation.](images/wfas-domainiso.gif) - -These goals, which correspond to [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md), provide the following benefits: - -- Devices in the isolated domain accept unsolicited inbound network traffic only when it can be authenticated as coming from another device in the isolated domain. Exemption rules can be defined to allow inbound traffic from trusted computers that for some reason can't perform IPsec authentication. - - For example, Woodgrove Bank wants all of its devices to block all unsolicited inbound network traffic from any device that it doesn't manage. The connection security rules deployed to domain member devices require authentication as a domain member or by using a certificate before an unsolicited inbound network packet is accepted. - -- Devices in the isolated domain can still send outbound network traffic to untrusted devices and receive the responses to the outbound requests. - - For example, Woodgrove Bank wants its users at client devices to be able to access Web sites on the Internet. The default Windows Defender Firewall settings for outbound network traffic allow this access. No other rules are required. - -These goals also support optional zones that can be created to add customized protection to meet the needs of subsets of an organization's devices: - -- Devices in the "boundary zone" are configured to use connection security rules that request but don't require authentication. This configuration enables them to receive unsolicited inbound network traffic from untrusted devices, and also to receive traffic from the other members of the isolated domain. - - For example, Woodgrove Bank has a server that must be accessed by its partners' devices through the Internet. The rules applied to devices in the boundary zone use authentication when the client device can support it, but don't block the connection if the client device can't authenticate. - -- Devices in the "encryption zone" require that all network traffic in and out must be encrypted to secure potentially sensitive material when it's sent over the network. - - For example, Woodgrove Bank wants the devices running SQL Server to only transmit data that is encrypted to help protect the sensitive data stored on those devices. - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md deleted file mode 100644 index 70a23e653f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Restrict Server Access to Members of a Group Only -description: Create a firewall rule to access isolated servers running Windows Server 2008 or later and restrict server access to members of a group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict Server Access to Members of a Group Only - - -After you have configured the IPsec connection security rules that force client devices to authenticate their connections to the isolated server, you must configure the rules that restrict access to only those devices or users who have been identified through the authentication process as members of the isolated server’s access group. - -In this topic: - -- [Create a firewall rule to access isolated servers running Windows Server 2008 or later](#to-create-a-firewall-rule-that-grants-access-to-an-isolated-server) - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To create a firewall rule that grants access to an isolated server - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). You must edit the GPO that applies settings to servers in the isolated server zone. - -2. In the navigation pane, right-click **Inbound Rules**, and then click **New Rule**. - -3. On the **Rule Type** page, click **Custom**, and then click **Next**. - -4. If you must restrict access to a single network program, then you can select **This program path**, and specify the program or service to which to grant access. Otherwise, click **All programs**, and then click **Next**. - -5. If you must restrict access to only some TCP or UDP port numbers, then enter the port numbers on the **Protocol and Ports** page. Otherwise, set **Protocol type** to **Any**, and then click **Next**. - -6. On the **Scope** page, select **Any IP address** for both local and remote addresses, and then click **Next**. - -7. On the **Action** page, click **Allow the connection if it is secure**. If required by your design, you can also click **Customize** and select **Require the connections to be encrypted**. Click **Next**. - -8. On the **Users and Computers** page, select the check box for the type of accounts (computer or user) you want to allow, click **Add**, and then enter the group account that contains the device and user accounts permitted to access the server. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md deleted file mode 100644 index 8ac3b50872..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Server Isolation GPOs -description: Learn about required GPOs for isolation zones and how many server isolation zones you need in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation GPOs - -Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The *Woodgrove Bank* example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. *Woodgrove Bank* copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. - -All of the device accounts for devices in the SQL Server server isolation zone are added to the group *CG_SRVISO_WGBANK_SQL*. This group is granted **Read** and **Apply Group Policy** permissions in on the GPOs described in this section. The GPOs are only for server versions of Windows. Client devices aren't expected to be members of the server isolation zone, although they can access the servers in the zone by being a member of a network access group (NAG) for the zone. - -## GPO_SRVISO - -This GPO is identical to the *GPO_DOMISO_Encryption* GPO with the following changes: - -- The firewall rule that enforces encryption is modified to include the NAGs on the **Users and Computers** tab of the rule. The NAGs-granted permissions include *CG_NAG_SQL_Users* and *CG_NAG_SQL_Computers*. - -## Next steps - -> [!div class="nextstepaction"] -> Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. -> -> -> [Plan GPO Deployment >](planning-gpo-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md deleted file mode 100644 index 2a049a459f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Server Isolation Policy Design Example -description: Learn about server isolation policy design in Windows Defender Firewall with Advanced Security by referring to this example of a fictitious company. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation Policy Design Example - -This design example continues to use the fictitious company *Woodgrove Bank*, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. - -In addition to the protections provided by the firewall and domain isolation, *Woodgrove Bank* wants to provide extra protection to the devices that are running Microsoft SQL Server for the WGBank program. They contain personal data, including each customer's financial history. Government and industry rules and regulations specify that access to this information must be restricted to only those users who have a legitimate business need. These rules and regulations include a requirement to prevent interception of and access to the information when it is in transit over the network. - -The information presented by the WGBank front-end servers to the client devices, and the information presented by the WGPartner servers to the remote partner devices, aren't considered sensitive for the purposes of the government regulations, because they're processed to remove sensitive elements before transmitting the data to the client devices. - -In this guide, the examples show server isolation layered on top of a domain isolation design. If you have an isolated domain, the client devices are already equipped with GPOs that require authentication. You only have to add settings to the isolated server(s) to require authentication on inbound connections, and to check for membership in the NAG. The connection attempt succeeds only if NAG membership is confirmed. - -## Server isolation without domain isolation - -Server isolation can also be deployed by itself, to only the devices that must participate. The GPO on the server is no different from the one discussed in the previous paragraph for a server in an existing isolated domain. The difference is that you must also deploy a GPO with supporting connection security rules to the clients that must be able to communicate with the isolated server. Because those devices must be members of the NAG, that group can also be used in a security group filter on the client GPO. That GPO must contain rules that support the authentication requirements of the isolated server. - -In short, instead of applying the client GPO to all clients in the domain, you apply the GPO to only the members of the NAG. - -If you don't have an Active Directory domain, you can manually apply the connection security rules, use a netsh command-line script, or use a Windows PowerShell script to help automate the configuration of the rules on larger numbers of devices. If you don't have an Active Directory domain, you can't use the Kerberos V5 protocol, but instead must provide the clients and the isolated servers with certificates that are referenced in the connection security rules. - -## Design requirements - -In addition to the protection provided by the firewall rules and domain isolation described in the previous design examples, the network administrators want to implement server isolation to help protect the sensitive data stored on the devices that run SQL Server. - -The following illustration shows the traffic protection needs for this design example. - -![isolated server example.](images/wfas-design3example1.gif) - -1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. These accounts include the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it's sent from an authorized computer. Authorization is determined by membership in a network access group (NAG) -1. All network traffic to and from the SQL Server devices must be encrypted -1. Client devices or users whose accounts aren't members of the NAG can't access the isolated servers - -### Other traffic notes - -- All of the design requirements shown in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced -- All of the design requirements shown in the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section are still enforced - -## Design details - -*Woodgrove Bank* uses Active Directory groups and GPOs to deploy the server isolation settings and rules to the devices on its network. - -As in the previously described policy design examples, GPOs to implement the domain isolation environment are linked to the domain container in Active Directory, and then WMI filters and security group filters are attached to GPOs to ensure that the correct GPO is applied to each computer. The following groups were created by using the Active Directory Users and Computers snap-in, and all devices that run Windows were added to the correct groups. - -- **CG_SRVISO_WGBANK_SQL**. This group contains the computer accounts for the devices that run SQL Server. Members of this group receive a GPO with firewall and connections security rules that require that only users who are members of the group CG_NAG_SQL_USERS can access the server, and only when they're using a computer that is a member of the group CG_NAG_SQL_COMPUTERS. - - > [!NOTE] - > You can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - - Network access groups (NAGs) aren't used to determine which GPOs are applied to a computer. Instead, these groups determine which users and devices can access the services on the isolated server. - -- **CG_NAG_SQL_COMPUTERS**. This network access group contains the computer accounts that are able to access the devices running SQL Server hosting the WGBank data. Members of this group include the WGBank front-end servers, and some client devices from which SQL Server administrators are permitted to work on the servers. -- **CG_NAG_SQL_USERS**. This network access group contains the user accounts of users who are permitted to access the SQL Server devices that host the WGBank data. Members of this group include the service account that the WGBank front-end program uses to run on its devices, and the user accounts for the SQL Server administration team members. - -> [!NOTE] -> You can use a single group for both user and computer accounts. Woodgrove Bank chose to keep them separate for clarity. - -If Woodgrove Bank wants to implement server isolation without domain isolation, the *CG_NAG_SQL_COMPUTERS* group can also be attached as a security group filter on the GPOs that apply connection security rules to the client devices. By doing this task, all the devices that are authorized to access the isolated server also have the required connection security rules. - -You don't have to include the encryption-capable rules on all devices. Instead, you can create GPOs that are applied only to members of the NAG, in addition to the standard domain isolation GPO, that contains connection security rules to support encryption. - -> [!div class="nextstepaction"] -> -> [Certificate-based Isolation Policy Design Example >](certificate-based-isolation-policy-design-example.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md deleted file mode 100644 index c3a7d7762f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Server Isolation Policy Design -description: Learn about server isolation policy design, where you assign servers to a zone that allows access only to members of an approved network access group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation Policy Design - -In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). - -This design typically begins with a network configured as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. For this design, you then create zones for servers that have more security requirements. The zones can limit access to the server to only members of authorized groups, and can optionally require the encryption of all traffic in or out of these servers. These restrictions and requirements can be done on a per-server basis, or for a group of servers that share common security requirements. - -You can implement a server isolation design without using domain isolation. To do this implementation, you use the same principles as domain isolation, but instead of applying them to an Active Directory domain, you apply them only to the devices that must be able to access the isolated servers. The GPO contains connection security and firewall rules that require authentication when communicating with the isolated servers. In this case, the NAGs that determine which users and devices can access the isolated server are also used to determine which devices receive the GPO. - -The design is shown in the following illustration, with arrows that show the permitted communication paths. - -![isolated domain with isolated server.](images/wfas-domainisohighsec.gif) - -Characteristics of this design include: - -- Isolated domain (area A) - The same isolated domain described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. If the isolated domain includes a boundary zone, then devices in the boundary zone behave just like other members of the isolated domain in the way that they interact with devices in server isolation zones. -- Isolated servers (area B) - Devices in the server isolation zones restrict access to devices, and optionally users, that authenticate as a member of a network access group (NAG) authorized to gain access. -- Encryption zone (area C) - If the data being exchanged is sufficiently sensitive, the connection security rules for the zone can also require that the network traffic be encrypted. Encryption zones are most often implemented as rules that are part of a server isolation zone, instead of as a separate zone. The diagram illustrates the concept as a subset for conceptual purposes only. - -To add support for server isolation, you must ensure that the authentication methods are compatible with the requirements of the isolated server. For example, if you want to authorize user accounts that are members of a NAG in addition to authorizing computer accounts, you must enable both user and computer authentication in your connection security rules. - -> [!IMPORTANT] -> This design builds on the [Domain Isolation Policy Design](domain-isolation-policy-design.md), which in turn builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md). If you plan to deploy all three designs, do the design work for all three together, and then deploy in the sequence presented. - -This design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). -- To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). -- To help you make the decisions required in this design, see [Planning Server Isolation Zones](planning-server-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). -- For a list of tasks that you can use to deploy your server isolation policy design, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). - -> [!div class="nextstepaction"] -> -> [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml new file mode 100644 index 0000000000..28a9741aa4 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -0,0 +1,41 @@ +items: + - name: Overview + href: windows-firewall-with-advanced-security.md + - name: Configure Windows Firewall + href: best-practices-configuring.md + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md + - name: Configure the Windows Firewall log + href: configure-the-windows-firewall-log.md + - name: Secure connections with IPsec + href: securing-end-to-end-ipsec-connections-by-using-ikev2.md + - name: Configure Windows Firewall with PowerShell + href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md + - name: Isolate Microsoft Store apps on your network + href: isolating-apps-on-your-network.md + - name: Firewall rules + items: + - name: Create firewall rules with Microsoft Intune + href: create-windows-firewall-rules-in-intune.md + - name: Create an inbound ICMP rule + href: create-an-inbound-icmp-rule.md + - name: Create an inbound port rule + href: create-an-inbound-port-rule.md + - name: Create an inbound program or service rule + href: create-an-inbound-program-or-service-rule.md + - name: Create an outbound port rule + href: create-an-outbound-port-rule.md + - name: Create an outbound program or service rule + href: create-an-outbound-program-or-service-rule.md + - name: Create inbound rules to support RPC + href: create-inbound-rules-to-support-rpc.md + - name: Troubleshoot + items: + - name: Troubleshoot UWP app connectivity issues in Windows Firewall + href: troubleshooting-uwp-firewall.md + - name: Filter origin audit log improvements + href: filter-origin-documentation.md + - name: Quarantine behavior + href: quarantine.md + - name: Firewall settings lost on upgrade + href: firewall-settings-lost-on-upgrade.md \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md deleted file mode 100644 index 91091b431c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -description: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior - - -To enable Windows Defender Firewall with Advanced Security and configure its default behavior, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To enable Windows Defender Firewall and configure the default behavior - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. - -3. For each network location type (Domain, Private, Public), perform the following steps. - - >**Note:**  The steps shown here indicate the recommended values for a typical deployment. Use the settings that are appropriate for your firewall design. - - 1. Click the tab that corresponds to the network location type. - - 2. Change **Firewall state** to **On (recommended)**. - - 3. Change **Inbound connections** to **Block (default)**. - - 4. Change **Outbound connections** to **Allow (default)**. - -  - -  - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md deleted file mode 100644 index e397c3d8a7..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Understand WFAS Deployment -description: Resources for helping you understand the Windows Defender Firewall with Advanced Security (WFAS) Design Process -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Understanding the Windows Defender Firewall with Advanced Security Design Process - -Designing any deployment starts by performing several important tasks: - -- [Identifying your windows defender firewall with advanced security design goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) - -- [Mapping your implementation goals to a Windows Defender Firewall with Advanced Security design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) - - -After you identify your implementation goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: - -- [Designing A Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) - -- [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) - -**Next:** [Identifying Your Windows Defender Firewall with Advanced Security Design Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md deleted file mode 100644 index 686e2d1efc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Verify That Network Traffic Is Authenticated -description: Learn how to confirm that network traffic is being protected by IPsec authentication after you configure your domain isolation rule to require authentication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Verify That Network Traffic Is Authenticated - - -After you've configured your domain isolation rule to request, rather than require, authentication, you must confirm that the network traffic sent by the devices on the network is being protected by IPsec authentication as expected. If you switch your rules to require authentication before all of the devices have received and applied the correct GPOs, or if there are any errors in your rules, then communications on the network can fail. By first setting the rules to request authentication, any network connections that fail authentication can continue in clear text while you diagnose and troubleshoot. - -In these procedures, you confirm that the rules you deployed are working correctly. Your next steps depend on which zone you're working on: - -- **Main domain isolation zone.** Before you convert your main domain isolation IPsec rule from request mode to require mode, you must make sure that the network traffic is protected according to your design. By configuring your rules to request and not require authentication at the beginning of operations, devices on the network can continue to communicate even when the main mode authentication or quick mode integrity and encryption rules aren't working correctly. For example, if your encryption zone contains rules that require a certain encryption algorithm, but that algorithm isn't included in a security method combination on the clients, then those clients can't successfully negotiate a quick mode security association, and the server refuses to accept network traffic from the client. By first using request mode only, you have the opportunity to deploy your rules and then examine the network traffic to see if they're working as expected without risking a loss of communications. - -- **Boundary zone.** Confirming correct operation of IPsec is the last step if you're working on the boundary zone GPO. You don't convert the GPO to require mode at any time. - -- **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode. - -> [!NOTE] -> In addition to the steps shown in this procedure, you can also use network traffic capture tools such as [Microsoft Network Monitor](https://www.microsoft.com/download/4865). Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To verify that network connections are authenticated by using the Windows Defender Firewall with Advanced Security console - -1. Open the Windows Defender Firewall with Advanced Security -console. - -2. In the navigation pane, expand **Monitoring**, and then click **Connection Security Rules**. - - The details pane displays the rules currently in effect on the device. - -3. **To display the Rule Source column** - - 1. In the **Actions** pane, click **View**, and then click **Add/Remove Columns**. - - 2. In the **Available columns** list, select **Rule Source**, and then click **Add**. - - 3. Use the **Move up** and **Move down** buttons to rearrange the order. Click **OK** when you're finished. - - It can take a few moments for the list to be refreshed with the newly added column. - -4. Examine the list for the rules from GPOs that you expect to be applied to this device. - - >**Note:**  If the rules do not appear in the list, then troubleshoot the GPO security group and the WMI filters that are applied to the GPO. Make sure that the local device is a member of the appropriate groups and meets the requirements of the WMI filters. -5. In the navigation pane, expand **Security Associations**, and then click **Main Mode**. - - The current list of main mode associations that have been negotiated with other devices appears in the details column. - -6. Examine the list of main mode security associations for sessions between the local device and the remote device. Make sure that the **1st Authentication Method** and **2nd Authentication Method** columns contain expected values. If your rules specify only a first authentication method, then the **2nd Authentication Method** column displays **No authentication**. If you double-click the row, then the **Properties** dialog box appears with more details about the security association. - -7. In the navigation pane, click **Quick mode**. - -8. Examine the list of quick mode security associations for sessions between the local device and the remote device. Make sure that the **AH Integrity**, **ESP integrity**, and **ESP Confidentiality** columns contain expected values. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md deleted file mode 100644 index 7e97506932..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Windows Defender Firewall with Advanced Security deployment overview -description: Use this guide to deploy Windows Defender Firewall with Advanced Security for your enterprise to help protect devices and data that they share across a network. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Windows Defender Firewall with Advanced Security deployment overview - - -You can use the Windows Defender Firewall with Advanced Security MMC snap-in with devices running at least Windows Vista or Windows Server 2008 to help protect the devices and the data that they share across a network. - -You can use Windows Defender Firewall to control access to the device from the network. You can create rules that allow or block network traffic in either direction based on your business requirements. You can also create IPsec connection security rules to help protect your data as it travels across the network from device to device. - -## About this guide - -This guide is intended for use by system administrators and system engineers. It provides detailed guidance for deploying a Windows Defender Firewall with Advanced Security design that you or an infrastructure specialist or system architect in your organization has selected. - -Begin by reviewing the information in [Planning to Deploy Windows Defender Firewall with Advanced Security](planning-to-deploy-windows-firewall-with-advanced-security.md). - -If you haven't yet selected a design, we recommend that you wait to follow the instructions in this guide until after you've reviewed the design options in the [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md) and selected the one most appropriate for your organization. - -After you select your design and gather the required information about the zones (isolation, boundary, and encryption), operating systems to support, and other details, you can then use this guide to deploy your Windows Defender Firewall with Advanced Security design in your production environment. This guide provides steps for deploying any of the following primary designs that are described in the Design Guide: - -- [Basic Firewall Policy Design](basic-firewall-policy-design.md) - -- [Domain Isolation Policy Design](domain-isolation-policy-design.md) - -- [Server Isolation Policy Design](server-isolation-policy-design.md) - -- [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) - -Use the checklists in [Implementing Your Windows Defender Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) to determine how best to use the instructions in this guide to deploy your particular design. -> [!CAUTION] -> We recommend that you use the techniques documented in this guide only for GPOs that must be deployed to the majority of the devices in your organization, and only when the OU hierarchy in your Active Directory domain does not match the deployment needs of these GPOs. These characteristics are typical of GPOs for server and domain isolation scenarios, but are not typical of most other GPOs. When the OU hierarchy supports it, deploy a GPO by linking it to the lowest level OU that contains all of the accounts to which the GPO applies. - -In a large enterprise environment with hundreds or thousands of GPOs, using this technique with too many GPOs can result in user or device accounts that are members of an excessive number of groups; this creation of accounts can result in network connectivity problems if network protocol limits are exceeded. -  -## What this guide doesn't provide - -This guide doesn't provide: - -- Guidance for creating firewall rules for specific network applications. For this information, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) in the Windows Defender Firewall with Advanced Security Design Guide. - -- Guidance for setting up Active Directory Domain Services (AD DS) to support Group Policy. - -- Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. - -For more information about Windows Defender Firewall with Advanced Security, see [Windows Defender Firewall with Advanced Security Overview](windows-firewall-with-advanced-security.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md deleted file mode 100644 index 02d6c56ae0..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Windows Defender Firewall with Advanced Security design guide -description: Learn about common goals for using Windows Defender Firewall with Advanced Security to choose or create a design for deploying the firewall in your enterprise. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Windows Defender Firewall with Advanced Security design guide - - -Windows Defender Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Defender Firewall supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't authenticate can't communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices. - -The interface for Windows Defender Firewall is much more capable and flexible than the consumer-friendly interface found in the Windows Defender Firewall Control Panel. They both interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel meets the needs for protecting a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. - -For more overview information, see [Windows Defender Firewall with Advanced Security](windows-firewall-with-advanced-security.md). - -## About this guide - -This guide provides recommendations to help you to choose or create a design for deploying Windows Defender Firewall in your enterprise environment. The guide describes some of the common goals for using Windows Defender Firewall, and then helps you map the goals that apply to your scenario to the designs that are presented in this guide. - -This guide is intended for the IT professional who has been assigned the task of deploying firewall and IPsec technologies on an organization's network to help meet the organization's security goals. - -Windows Defender Firewall should be part of a comprehensive security solution that implements various security technologies, such as perimeter firewalls, intrusion detection systems, virtual private networking (VPN), IEEE 802.1X authentication for wireless and wired connections, and IPsec connection security rules. - -To successfully use this guide, you need a good understanding of both the capabilities provided by Windows Defender Firewall, and how to deliver configuration settings to your managed devices by using Group Policy in Active Directory. - -You can use the implementation goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those goals presented here: - -- **Basic firewall policy design**. Restricts network traffic in and out of your devices to only that which is needed and authorized. - -- **Domain isolation policy design**. Prevents devices that are domain members from receiving unsolicited network traffic from devices that aren't domain members. More "zones" can be established to support the special requirements of some devices, such as: - - - A "boundary zone" for devices that must be able to receive requests from non-isolated devices. - - - An "encryption zone" for devices that store sensitive data that must be protected during network transmission. - -- **Server isolation policy design**. Restricts access to a server to only a limited group of authorized users and devices. This server can be commonly configured as a zone in a domain isolation design, but can also be configured as a stand-alone design, providing many of the benefits of domain isolation to a small set of devices. - -- **Certificate-based isolation policy design**. This design is a complement to either of the previous two designs, and supports any of their capabilities. It uses cryptographic certificates that are deployed to clients and servers for authentication, instead of the Kerberos V5 authentication used by default in Active Directory. This design enables devices that aren't part of an Active Directory domain, such as devices running operating systems other than Windows, to participate in your isolation solution. - -In addition to descriptions and example for each design, you'll find guidelines for gathering required data about your environment. You can then use these guidelines to plan and design your Windows Defender Firewall with Advanced Security deployment. After you read this guide, and finish gathering, documenting, and mapping your organization's requirements, you have the information that you need to begin deploying Windows Defender Firewall using the guidance in the Windows Defender Firewall with Advanced Security Deployment Guide. - -You can find the Windows Defender Firewall with Advanced Security -Deployment Guide at these locations: - -- [Windows Defender Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) - -- (Downloadable Word document) - -## In this section - -| Topic | Description -| - | - | -| [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) | Learn how to get started with the Windows Defender Firewall with Advanced Security design process. | -| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security implementation goals. | -| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | -| [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) | To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. | -| [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) | After you've gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. | -| [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) | You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). | - -## Terminology used in this guide - -The following table identifies and defines terms used throughout this guide. - -| Term | Definition | -| - | - | -| Active Directory domain | A group of devices and users managed by an administrator by using Active Directory Domain Services (AD DS). Devices in a domain share a common directory database and security policies. Multiple domains can co-exist in a "forest," with trust relationships that establish the forest as the security boundary. | -| Authentication | A process that enables the sender of a message to prove its identity to the receiver. For connection security in Windows, authentication is implemented by the IPsec protocol suite.| -| Boundary zone | A subset of the devices in an isolated domain that must be able to receive unsolicited and non-authenticated network traffic from devices that aren't members of the isolated domain. Devices in the boundary zone request but don't require authentication. They use IPsec to communicate with other devices in the isolated domain.| -| Connection security rule | A rule in Windows Defender Firewall that contains a set of conditions and an action to be applied to network packets that match the conditions. The action can allow the packet, block the packet, or require the packet to be protected by IPsec. In previous versions of Windows, this rule was called an *IPsec rule*.| -| Certificate-based isolation | A way to add devices that can't use Kerberos V5 authentication to an isolated domain, by using an alternate authentication technique. Every device in the isolated domain and the devices that can't use Kerberos V5 are provided with a device certificate that can be used to authenticate with each other. Certificate-based isolation requires a way to create and distribute an appropriate certificate (if you choose not to purchase one from a commercial certificate provider).| -| Domain isolation | A technique for helping protect the devices in an organization by requiring that the devices authenticate each other's identity before exchanging information, and refusing connection requests from devices that can't authenticate. Domain isolation takes advantage of Active Directory domain membership and the Kerberos V5 authentication protocol available to all members of the domain. Also see "Isolated domain" in this table.| -| Encryption zone | A subset of the devices in an isolated domain that process sensitive data. Devices that are part of the encryption zone have all network traffic encrypted to prevent viewing by non-authorized users. Devices that are part of the encryption zone also typically are subject to the access control restrictions of server isolation.| -| Firewall rule | A rule in Windows Defender Firewall that contains a set of conditions used to determine whether a network packet is allowed to pass through the firewall.
By default, the firewall rules in Windows Server 2016. Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 11, Windows 10, Windows 8, Windows 7, and Windows Vista block unsolicited inbound network traffic. Likewise, by default, all outbound network traffic is allowed. The firewall included in previous versions of Windows only filtered inbound network traffic. | -| Internet Protocol security (IPsec) | A set of industry-standard, cryptography-based protection services and protocols. IPsec protects all protocols in the TCP/IP protocol suite except Address Resolution Protocol (ARP).| -| IPsec policy | A collection of connection security rules that provide the required protection to network traffic entering and leaving the device. The protection includes authentication of both the sending and receiving device, integrity protection of the network traffic exchanged between them, and can include encryption.| -| Isolated domain | An Active Directory domain (or an Active Directory forest, or set of domains with two-way trust relationships) that has Group Policy settings applied to help protect its member devices by using IPsec connection security rules. Members of the isolated domain require authentication on all unsolicited inbound connections (with exceptions handled by the other zones).
In this guide, the term *isolated domain* refers to the IPsec concept of a group of devices that can share authentication. The term *Active Directory domain* refers to the group of devices that share a security database by using Active Directory.| -| Server isolation | A technique for using group membership to restrict access to a server that is typically already a member of an isolated domain. The extra protection comes from using the authentication credentials of the requesting device to determine its group membership, and then only allowing access if the computer account (and optionally the user account) is a member of an authorized group.| -| Solicited network traffic | Network traffic that is sent in response to a request. By default, Windows Defender Firewall allows all solicited network traffic through.| -| Unsolicited network traffic | Network traffic that isn't a response to an earlier request, and that the receiving device can't necessarily anticipate. By default, Windows Defender Firewall blocks all unsolicited network traffic. | -| Zone | A zone is a logical grouping of devices that share common IPsec policies because of their communications requirements. For example, the boundary zone permits inbound connections from non-trusted devices. The encryption zone requires that all connections be encrypted.
This term zone isn't related to the one used by Domain Name System (DNS). | - -**Next:** [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) - -  - -  - - - - - diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index b1bfa3ebb1..3daa0cbf86 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -4,7 +4,6 @@ description: This article describes how Windows security features help protect y ms.topic: conceptual ms.date: 08/11/2023 ms.collection: - - highpri - tier1 --- diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index 1970d566b4..5ff128f685 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -3,9 +3,6 @@ title: Windows Security description: Windows Security brings together common Windows security features into one place. ms.date: 08/11/2023 ms.topic: article -ms.collection: - - highpri - - tier2 --- # Windows Security diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 69e56ca8f4..ff13a406b5 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -1,7 +1,7 @@ --- title: Enhanced Phishing Protection in Microsoft Defender SmartScreen description: Learn how Enhanced Phishing Protection for Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. -ms.date: 09/25/2023 +ms.date: 11/02/2023 ms.topic: conceptual appliesto: - ✅ Windows 11, version 22H2 @@ -19,7 +19,7 @@ If a user signs into Windows using a password, Enhanced Phishing Protection work - If users type their work or school password into a website or app that SmartScreen finds suspicious, Enhanced Phishing Protection can automatically collect information from that website or app to help identify security threats. For example, the content displayed, sounds played, and application memory. > [!NOTE] -> When a user signs-in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to Microsoft Defender for Endpoint. +> When a user signs-in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to [Microsoft Defender for Endpoint (MDE)](/microsoft-365/security/defender-endpoint/). ## Benefits of Enhanced Phishing Protection in Microsoft Defender SmartScreen @@ -37,43 +37,51 @@ Enhanced Phishing Protection provides robust phishing protections for work or sc ## Configure Enhanced Phishing Protection for your organization -Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP. +Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. These settings are available to configure your devices using either Microsoft Intune, GPO or CSP. + +| Setting | Description | +|--|--| +| Automatic Data Collection | This policy setting determines whether Enhanced Phishing Protection can collect additional information-such as content displayed, sounds played, and application memory-when your users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious.

  • If you enable this policy setting, Enhanced Phishing Protection may automatically collect additional content for security analysis from a suspicious website or app when your users enter their work or school password into that website or app.
  • If you disable this policy setting, Enhanced Phishing Protection won't collect additional content for security analysis when your users enter their work or school password into a suspicious site or app.
  • If this policy isn't set, Enhanced Phishing Protection automatic data collection honors the end user's settings.
    • | +| Service Enabled | This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | +| Notify Malicious | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above. | +| Notify Password Reuse | This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password. | +| Notify Unsafe App | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps. | + +Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP. #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) To configure devices using Microsoft Intune, create a [**Settings catalog** policy][MEM-2], and use the settings listed under the category **`SmartScreen > Enhanced Phishing Protection`**: -|Setting|Description| -|---------|---------| -|Service Enabled |This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | -|Notify Malicious|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above.| -|Notify Password Reuse |This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password.| -|Notify Unsafe App|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps.| +- Automatic Data Collection +- Service Enabled +- Notify Malicious +- Notify Password Reuse +- Notify Unsafe App Assign the policy to a security group that contains as members the devices or users that you want to configure. #### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo) -Enhanced Phishing Protection can be configured using the following Administrative Templates policy settings: +Enhanced Phishing Protection can be configured using the following group policy settings found under **Administrative Templates > Windows Components > Windows Defender SmartScreen > Enhanced Phishing Protection**: -|Setting|Description| -|---------|---------| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Service Enabled |This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Malicious|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Password Reuse |This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Unsafe App|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps.| +- Automatic Data Collection +- Service Enabled +- Notify Malicious +- Notify Password Reuse +- Notify Unsafe App #### [:::image type="icon" source="images/icons/windows-os.svg"::: **CSP**](#tab/csp) Enhanced Phishing Protection can be configured using the [WebThreatDefense CSP][WIN-1]. -| Setting | OMA-URI | Data type | -|-------------------------|---------------------------------------------------------------------------|-----------| -| **AutomaticDataCollection** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection` | Integer | -| **NotifyMalicious** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyMalicious` | Integer | -| **NotifyPasswordReuse** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyPasswordReuse` | Integer | -| **NotifyUnsafeApp** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyUnsafeApp` | Integer | -| **ServiceEnabled** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/ServiceEnabled` | Integer | +| Setting | OMA-URI | Data type | +|-----------------------------|-------------------------------------------------------------------------------|-----------| +| **AutomaticDataCollection** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection` | Integer | +| **NotifyMalicious** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyMalicious` | Integer | +| **NotifyPasswordReuse** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyPasswordReuse` | Integer | +| **NotifyUnsafeApp** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyUnsafeApp` | Integer | +| **ServiceEnabled** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/ServiceEnabled` | Integer | --- @@ -90,33 +98,44 @@ By default, Enhanced Phishing Protection is deployed in audit mode, preventing n | Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen settings. + +| Setting | Default Value | Recommendation | +|---------------------------|------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Automatic Data Collection | **Disabled** for domain joined devices or devices enrolled with MDM.
    **Enabled** for all other devices. | **Enabled**: Turns on collection of additional content when users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious. | +| Service Enabled | **Enabled** | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | +| Notify Malicious | **Disabled** for devices onboarded to MDE.
    **Enabled** for all other devices. | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | +| Notify Password Reuse | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | +| Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | + #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) -|Settings catalog element|Recommendation| -|---------|---------| -|Service Enabled|**Enable**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users.| -|Notify Malicious|**Enable**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password.| -|Notify Password Reuse|**Enable**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password.| -|Notify Unsafe App|**Enable**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps.| +| Settings catalog element | Recommended value | +|---------------------------|-------------------| +| Automatic Data Collection | **Enabled** | +| Service Enabled | **Enabled** | +| Notify Malicious | **Enabled** | +| Notify Password Reuse | **Enabled** | +| Notify Unsafe App | **Enabled** | #### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo) -|Group Policy setting|Recommendation| -|---------|---------| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Service Enabled| **Enable**: Enhanced Phishing Protection is enabled in audit mode and your users are unable to turn it off.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Malicious|**Enable**: Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate. It encourages users to change their password.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Password Reuse|**Enable**: Enhanced Phishing Protection warns users if they reuse their work or school password and encourages them to change it.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Unsafe App|**Enable**: Enhanced Phishing Protection warns users if they store their password in Notepad and Microsoft 365 Office Apps.| +| Group Policy setting | Recommended value | +|---------------------------|-------------------| +| Automatic Data Collection | **Enabled** | +| Service Enabled | **Enabled** | +| Notify Malicious | **Enabled** | +| Notify Password Reuse | **Enabled** | +| Notify Unsafe App | **Enabled** | #### [:::image type="icon" source="images/icons/windows-os.svg"::: **CSP**](#tab/csp) -|MDM setting|Recommendation| -|---------|---------| -|ServiceEnabled|**1**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users.| -|NotifyMalicious|**1**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password.| -|NotifyPasswordReuse|**1**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password.| -|NotifyUnsafeApp|**1**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps.| - +| MDM setting | Recommended value | +|-------------------------|-------------------| +| AutomaticDataCollection | **1** | +| ServiceEnabled | **1** | +| NotifyMalicious | **1** | +| NotifyPasswordReuse | **1** | +| NotifyUnsafeApp | **1** | --- @@ -129,7 +148,4 @@ To better help you protect your organization, we recommend turning on and using [WIN-1]: /windows/client-management/mdm/policy-csp-webthreatdefense - [MEM-2]: /mem/intune/configuration/settings-catalog - - diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md index 9b52d9fb84..b5af241045 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md @@ -2,11 +2,7 @@ title: Microsoft Defender SmartScreen overview description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. ms.date: 08/11/2023 -ms.topic: article -ms.localizationpriority: high -ms.collection: - - tier2 - - highpri +ms.topic: conceptual appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/security/security-foundations/certification/fips-140-validation.md b/windows/security/security-foundations/certification/fips-140-validation.md index 1cb3c7c91f..295dd13ce0 100644 --- a/windows/security/security-foundations/certification/fips-140-validation.md +++ b/windows/security/security-foundations/certification/fips-140-validation.md @@ -1,18 +1,10 @@ --- title: Federal Information Processing Standard (FIPS) 140 Validation description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. -ms.prod: windows-client -ms.date: 08/18/2023 -manager: aaroncz +ms.date: 11/13/2023 +ms.topic: reference ms.author: paoloma author: paolomatarazzo -ms.collection: - - highpri - - tier3 -ms.topic: reference -ms.localizationpriority: medium -ms.reviewer: -ms.technology: itpro-security --- # FIPS 140-2 Validation @@ -21,7 +13,7 @@ ms.technology: itpro-security The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard. FIPS is based on Section 5131 of the Information Technology Management Reform Act of 1996. It defines the minimum security requirements for cryptographic modules in IT products. -The [Cryptographic Module Validation Program (CMVP)][HTTP-1]) is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. +The [Cryptographic Module Validation Program (CMVP)][HTTP-1] is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. ## Microsoft's approach to FIPS 140-2 validation diff --git a/windows/security/security-foundations/certification/windows-platform-common-criteria.md b/windows/security/security-foundations/certification/windows-platform-common-criteria.md index 0f426874c2..d342773f2c 100644 --- a/windows/security/security-foundations/certification/windows-platform-common-criteria.md +++ b/windows/security/security-foundations/certification/windows-platform-common-criteria.md @@ -1,17 +1,13 @@ --- title: Common Criteria Certifications description: This topic details how Microsoft supports the Common Criteria certification program. -ms.prod: windows-client ms.author: sushmanemali author: s4sush -manager: aaroncz ms.topic: reference -ms.localizationpriority: medium ms.date: 11/4/2022 ms.reviewer: paoloma -ms.technology: itpro-security ms.collection: - - tier3 +- tier3 --- # Common Criteria certifications diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index 726f71bbbd..5ca11d5d60 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -166,83 +166,9 @@ Typically, **Primary Group** field for new user accounts has the following value > **Note**  **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. **Old UAC value** always **“0x0”** for new user accounts. This parameter contains the previous value of **userAccountControl** attribute of user object. +- **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the value of **userAccountControl** attribute of new user object. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. For new user accounts, when the object for this account was created, the **userAccountControl** value was considered to be **“0x0”**, and then it was changed from **“0x0”** to the real value for the account's **userAccountControl** attribute. See possible values in the table below. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4720 event. - -| Flag Name | userAccountControl in hexadecimal | userAccountControl in decimal | Description | User Account Control field text | -|------------------------------------|-----------------------------------|-------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------| -| SCRIPT | 0x0001 | 1 | The logon script will be run. | Changes of this flag do not show in 4720 events. | -| ACCOUNTDISABLE | 0x0002 | 2 | The user account is disabled. | Account Disabled
    Account Enabled | -| Undeclared | 0x0004 | 4 | This flag is undeclared. | Changes of this flag do not show in 4720 events. | -| HOMEDIR\_REQUIRED | 0x0008 | 8 | The home folder is required. | 'Home Directory Required' - Enabled
    'Home Directory Required' - Disabled | -| LOCKOUT | 0x0010 | 16 | | Changes of this flag do not show in 4720 events. | -| PASSWD\_NOTREQD | 0x0020 | 32 | No password is required. | 'Password Not Required' - Enabled
    'Password Not Required' - Disabled | -| PASSWD\_CANT\_CHANGE | 0x0040 | 64 | The user cannot change the password. This is a permission on the user's object. | Changes of this flag do not show in 4720 events. | -| ENCRYPTED\_TEXT\_PWD\_ALLOWED | 0x0080 | 128 | The user can send an encrypted password.
    Can be set using “Store password using reversible encryption” checkbox. | 'Encrypted Text Password Allowed' - Disabled
    'Encrypted Text Password Allowed' - Enabled | -| TEMP\_DUPLICATE\_ACCOUNT | 0x0100 | 256 | This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. This is sometimes referred to as a local user account. | Cannot be set for computer account. | -| NORMAL\_ACCOUNT | 0x0200 | 512 | This is a default account type that represents a typical user. | 'Normal Account' - Disabled
    'Normal Account' - Enabled | -| INTERDOMAIN\_TRUST\_ACCOUNT | 0x0800 | 2048 | This is a permit to trust an account for a system domain that trusts other domains. | Cannot be set for computer account. | -| WORKSTATION\_TRUST\_ACCOUNT | 0x1000 | 4096 | This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. | 'Workstation Trust Account' - Disabled
    'Workstation Trust Account' - Enabled | -| SERVER\_TRUST\_ACCOUNT | 0x2000 | 8192 | This is a computer account for a domain controller that is a member of this domain. | 'Server Trust Account' - Enabled
    'Server Trust Account' - Disabled | -| DONT\_EXPIRE\_PASSWORD | 0x10000 | 65536 | Represents the password, which should never expire on the account.
    Can be set using “Password never expires” checkbox. | 'Don't Expire Password' - Disabled
    'Don't Expire Password' - Enabled | -| MNS\_LOGON\_ACCOUNT | 0x20000 | 131072 | This is an MNS logon account. | 'MNS Logon Account' - Disabled
    'MNS Logon Account' - Enabled | -| SMARTCARD\_REQUIRED | 0x40000 | 262144 | When this flag is set, it forces the user to log on by using a smart card. | 'Smartcard Required' - Disabled
    'Smartcard Required' - Enabled | -| TRUSTED\_FOR\_DELEGATION | 0x80000 | 524288 | When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
    If you enable Kerberos constraint or unconstraint delegation or disable these types of delegation in Delegation tab you will get this flag changed. | 'Trusted For Delegation' - Enabled
    'Trusted For Delegation' - Disabled | -| NOT\_DELEGATED | 0x100000 | 1048576 | When this flag is set, the security context of the user is not delegated to a service even if the service account is set as trusted for Kerberos delegation.
    Can be set using “Account is sensitive and cannot be delegated” checkbox. | 'Not Delegated' - Disabled
    'Not Delegated' - Enabled | -| USE\_DES\_KEY\_ONLY | 0x200000 | 2097152 | Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
    Can be set using “Use Kerberos DES encryption types for this account” checkbox. | 'Use DES Key Only' - Disabled
    'Use DES Key Only' - Enabled | -| DONT\_REQ\_PREAUTH | 0x400000 | 4194304 | This account does not require Kerberos pre-authentication for logging on.
    Can be set using “Do not require Kerberos preauthentication” checkbox. | 'Don't Require Preauth' - Disabled
    'Don't Require Preauth' - Enabled | -| PASSWORD\_EXPIRED | 0x800000 | 8388608 | The user's password has expired. | Changes of this flag do not show in 4720 events. | -| TRUSTED\_TO\_AUTH\_FOR\_DELEGATION | 0x1000000 | 16777216 | The account is enabled for delegation. This is a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client's identity and authenticate as that user to other remote servers on the network.
    If you enable Kerberos protocol transition delegation or disable this type of delegation in Delegation tab you will get this flag changed. | 'Trusted To Authenticate For Delegation' - Disabled
    'Trusted To Authenticate For Delegation' - Enabled | -| PARTIAL\_SECRETS\_ACCOUNT | 0x04000000 | 67108864 | The account is a read-only domain controller (RODC). This is a security-sensitive setting. Removing this setting from an RODC compromises security on that server. | No information. | - -For new, manually created, domain or local user accounts typical flags are: - -- Account Disabled - -- 'Password Not Required' - Enabled - -- 'Normal Account' – Enabled - - After new user creation event you will typically see couple of “[4738](event-4738.md): A user account was changed.” events with new flags: - -- 'Password Not Required' – Disabled - -- Account Enabled - - +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field in “[4738](event-4738.md): A user account was changed.” This parameter might not be captured in the event, and in that case appears as “-”. For new local accounts this field typically has value “**<value not set>**”. diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index 61cd4e80e6..be3bf1a1e5 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -192,39 +192,9 @@ Typical **Primary Group** values for user accounts: > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of **userAccountControl** attribute of user object. +- **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. If the value of **userAccountControl** attribute of user object was changed, you will see the new value here. - -To decode this value, you can go through the property value definitions in the [User’s or Computer’s account UAC flags.](/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties) from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event. diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index a245d7e5ce..e26b0c96b3 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -170,69 +170,9 @@ Typically, **Primary Group** field for new computer accounts has the following v > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. **Old UAC value** always `0x0` for new computer accounts. This parameter contains the previous value of **userAccountControl** attribute of computer object. +- **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of **userAccountControl** attribute of new computer object. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. For new computer accounts, when the object for this account was created, the **userAccountControl** value was considered to be `0x0`, and then it was changed from `0x0` to the real value for the account's **userAccountControl** attribute. See possible values in the table below. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4741 event. - -| Flag Name | userAccountControl in hexadecimal | userAccountControl in decimal | Description | User Account Control field text | -|---|---|---|---|---| -| SCRIPT | 0x0001 | 1 | The logon script will be run. | Changes of this flag do not show in 4741 events. | -| ACCOUNTDISABLE | 0x0002 | 2 | The user account is disabled. | Account Disabled
    Account Enabled | -| Undeclared | 0x0004 | 4 | This flag is undeclared. | Changes of this flag do not show in 4741 events. | -| HOMEDIR\_REQUIRED | 0x0008 | 8 | The home folder is required. | 'Home Directory Required' - Enabled
    'Home Directory Required' - Disabled | -| LOCKOUT | 0x0010 | 16 | | Changes of this flag do not show in 4741 events. | -| PASSWD\_NOTREQD | 0x0020 | 32 | No password is required. | 'Password Not Required' - Enabled
    'Password Not Required' - Disabled | -| PASSWD\_CANT\_CHANGE | 0x0040 | 64 | The user cannot change the password. This is a permission on the user's object. | Changes of this flag do not show in 4741 events. | -| ENCRYPTED\_TEXT\_PWD\_ALLOWED | 0x0080 | 128 | The user can send an encrypted password.
    Can be set using “Store password using reversible encryption” checkbox. | 'Encrypted Text Password Allowed' - Disabled
    'Encrypted Text Password Allowed' - Enabled | -| TEMP\_DUPLICATE\_ACCOUNT | 0x0100 | 256 | This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. This is sometimes referred to as a local user account. | Cannot be set for computer account. | -| NORMAL\_ACCOUNT | 0x0200 | 512 | This is a default account type that represents a typical user. | 'Normal Account' - Disabled
    'Normal Account' - Enabled | -| INTERDOMAIN\_TRUST\_ACCOUNT | 0x0800 | 2048 | This is a permit to trust an account for a system domain that trusts other domains. | Cannot be set for computer account. | -| WORKSTATION\_TRUST\_ACCOUNT | 0x1000 | 4096 | This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. | 'Workstation Trust Account' - Disabled
    'Workstation Trust Account' - Enabled | -| SERVER\_TRUST\_ACCOUNT | 0x2000 | 8192 | This is a computer account for a domain controller that is a member of this domain. | 'Server Trust Account' - Enabled
    'Server Trust Account' - Disabled | -| DONT\_EXPIRE\_PASSWORD | 0x10000 | 65536 | Represents the password, which should never expire on the account.
    Can be set using “Password never expires” checkbox. | 'Don't Expire Password' - Disabled
    'Don't Expire Password' - Enabled | -| MNS\_LOGON\_ACCOUNT | 0x20000 | 131072 | This is an MNS logon account. | 'MNS Logon Account' - Disabled
    'MNS Logon Account' - Enabled | -| SMARTCARD\_REQUIRED | 0x40000 | 262144 | When this flag is set, it forces the user to log on by using a smart card. | 'Smartcard Required' - Disabled
    'Smartcard Required' - Enabled | -| TRUSTED\_FOR\_DELEGATION | 0x80000 | 524288 | When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
    If you enable Kerberos constraint or unconstraint delegation or disable these types of delegation in Delegation tab you will get this flag changed. | 'Trusted For Delegation' - Enabled
    'Trusted For Delegation' - Disabled | -| NOT\_DELEGATED | 0x100000 | 1048576 | When this flag is set, the security context of the user is not delegated to a service even if the service account is set as trusted for Kerberos delegation.
    Can be set using “Account is sensitive and cannot be delegated” checkbox. | 'Not Delegated' - Disabled
    'Not Delegated' - Enabled | -| USE\_DES\_KEY\_ONLY | 0x200000 | 2097152 | Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
    Can be set using “Use Kerberos DES encryption types for this account” checkbox. | 'Use DES Key Only' - Disabled
    'Use DES Key Only' - Enabled | -| DONT\_REQ\_PREAUTH | 0x400000 | 4194304 | This account does not require Kerberos pre-authentication for logging on.
    Can be set using “Do not require Kerberos preauthentication” checkbox. | 'Don't Require Preauth' - Disabled
    'Don't Require Preauth' - Enabled | -| PASSWORD\_EXPIRED | 0x800000 | 8388608 | The user's password has expired. | Changes of this flag do not show in 4741 events. | -| TRUSTED\_TO\_AUTH\_FOR\_DELEGATION | 0x1000000 | 16777216 | The account is enabled for delegation. This is a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client's identity and authenticate as that user to other remote servers on the network.
    If you enable Kerberos protocol transition delegation or disable this type of delegation in Delegation tab you will get this flag changed. | 'Trusted To Authenticate For Delegation' - Disabled
    'Trusted To Authenticate For Delegation' - Enabled | -| PARTIAL\_SECRETS\_ACCOUNT | 0x04000000 | 67108864 | The account is a read-only domain controller (RODC). This is a security-sensitive setting. Removing this setting from an RODC compromises security on that server. | No information. | - -> Table 7. User’s or Computer’s account UAC flags. +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field in “[4742](event-4742.md)(S): A computer account was changed.” This parameter might not be captured in the event, and in that case appears as `-`. diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index 6d58542822..4a82933448 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -197,43 +197,9 @@ Typical **Primary Group** values for computer accounts: > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of **userAccountControl** attribute of computer object. +- **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. If the value of **userAccountControl** attribute of computer object was changed, you will see the new value here. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: “Table 7. User’s or Computer’s account UAC flags.”. In the “User Account Control field text” column, you can see text that will be displayed in the **User Account Control** field in 4742 event. - - +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field. diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 2e3845bfba..1f4ad7580a 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 11/07/2023 +ms.date: 11/15/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -35,7 +35,8 @@ The features in this article are no longer being actively developed, and might b > If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/windows/send-feedback-to-microsoft-with-the-feedback-hub-app-f59187f8-8739-22d6-ba93-f66612949332). |Feature | Details and mitigation | Deprecation announced | -| --- | --- | --- | +| ----------- | --------------------- | ---- | +| Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | November 2023 | | Tips | The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed. | November 2023 | | Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | | Webclient (WebDAV) Service | The Webclient (WebDAV) service is deprecated. The Webclient service isn't started by default in Windows. For more information on WebDAV, see [WebDAV - Win32 apps](/windows/win32/webdav/webdav-portal). | November 2023 | diff --git a/windows/whats-new/temporary-enterprise-feature-control.md b/windows/whats-new/temporary-enterprise-feature-control.md index 122c8a1f8f..ba0ca795c1 100644 --- a/windows/whats-new/temporary-enterprise-feature-control.md +++ b/windows/whats-new/temporary-enterprise-feature-control.md @@ -73,5 +73,5 @@ The following features introduced through the monthly cumulative updates allow p | The **Recommended** section of the **Start Menu** displays personalized website recommendations |[September 2023 - KB5030310](https://support.microsoft.com/kb/5030310)| No |**CSP**: ./Device/Vendor/MSFT/Policy/Config/Start/[HideRecoPersonalizedSites](/windows/client-management/mdm/policy-csp-start)

    **Group Policy**: Computer Configuration\Administrative Templates\Start Menu and Taskbar\\**Remove Personalized Website Recommendations from the Recommended section in the Start Menu**| | **Recommended** section added to File Explorer Home for users signed into Windows with an Azure AD account. | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes | **CSP**:./Device/Vendor/MSFT/Policy/Config/FileExplorer/[DisableGraphRecentItems](/windows/client-management/mdm/policy-csp-fileexplorer#disablegraphrecentitems)

    **Group Policy**: Computer Configuration\Administrative Templates\Windows Components\File Explorer\\**Turn off files from Office.com in Quick Access View**

    **Note**: This control disables additional items beyond the **Recommended** items. Review the policy before implementing this control. | | Transfer files to another PC using WiFi direct|[September 2023 - KB5030310](https://support.microsoft.com/kb/5030310)|Yes|**CSP**: ./Device/Vendor/MSFT/Policy/Config/Wifi/[AllowWiFiDirect](/windows/client-management/mdm/policy-csp-wifi#allowwifidirect)| -| Copilot in Windows | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot)

    **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot**| +| Copilot in Windows | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSP**: ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot)

    **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot**| |Dev Drive | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSPs**:
    - ./Device/Vendor/MSFT/Policy/Config/FileSystem/[EnableDevDrive](/windows/client-management/mdm/policy-csp-filesystem#enableeeverive)
    - ./Device/Vendor/MSFT/Policy/Config/FileSystem/[DevDriveAttachPolicy](/windows/client-management/mdm/policy-csp-filesystem#devdriveattachpolicy)

    **Group Policies**:
    - Computer Configuration\Administrative Templates\System\FileSystem\\**Enable dev drive**
    - Computer Configuration\Administrative Templates\System\FileSystem\\**Dev drive filter attach policy**| diff --git a/windows/whats-new/whats-new-windows-10-version-1909.md b/windows/whats-new/whats-new-windows-10-version-1909.md index d40de13c9d..5ab89168fd 100644 --- a/windows/whats-new/whats-new-windows-10-version-1909.md +++ b/windows/whats-new/whats-new-windows-10-version-1909.md @@ -55,7 +55,7 @@ Windows 10, version 1909 also includes two new features called **Key-rolling** a ### Transport Layer Security (TLS) -An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 is disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 isn't built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. Also see [Microsoft Edge platform status](https://developer.microsoft.com/microsoft-edge/status/tls13/) +An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 is disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 isn't built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. >[!NOTE] >The experiental implementation of TLS 1.3 isn't supported. TLS 1.3 is only supported on Windows 11 and Server 2022. For more information, see [Protocols in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-).