mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 11:53:37 +00:00
Fixed half-formed notes & tips, added image borders
This commit is contained in:
Gary Moore
GitHub
@ -72,11 +72,13 @@ needs.<br>
|
||||
|
||||
2. Open **Groups > New Group**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Enter details and create a new group.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
4. Add your test user or device.
|
||||
|
||||
@ -86,7 +88,8 @@ needs.<br>
|
||||
|
||||
7. Find your test user or device and select it.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Your testing group now has a member to test.
|
||||
|
||||
@ -117,10 +120,11 @@ different types of Endpoint security policies.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
>In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp). <br> The following image is an example of what you'll see when Microsoft Defender ATP is NOT integrated with Intune: <br> 
|
||||
|
||||
|
||||
|
||||
> In this instance, this has been auto populated as Microsoft Defender ATP has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender ATP in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp).
|
||||
>
|
||||
> The following image is an example of what you'll see when Microsoft Defender ATP is NOT integrated with Intune:
|
||||
>
|
||||
> 
|
||||
|
||||
6. Add scope tags if necessary, then select **Next**.
|
||||
|
||||
@ -144,36 +148,43 @@ different types of Endpoint security policies.
|
||||
|
||||
2. Navigate to **Endpoint security > Antivirus > Create Policy**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Select **Platform - Windows 10 and Later - Windows and Profile – Microsoft
|
||||
Defender Antivirus > Create**.
|
||||
|
||||
4. Enter name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. In the **Configuration settings page**: Set the configurations you require for
|
||||
Microsoft Defender Antivirus (Cloud Protection, Exclusions, Real-Time
|
||||
Protection, and Remediation).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. Add scope tags if necessary, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Select groups to include, assign to your test group, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Review and create, then select **Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. You'll see the configuration policy you created.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Attack surface reduction rules
|
||||
|
||||
@ -186,37 +197,44 @@ different types of Endpoint security policies.
|
||||
4. Select **Platform - Windows 10 and Later – Profile - Attack surface reduction
|
||||
rules > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Enter a name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. In the **Configuration settings page**: Set the configurations you require for
|
||||
Attack surface reduction rules, then select **Next**.
|
||||
|
||||
> [!NOTE]
|
||||
> We will be configuring all of the Attack surface reduction rules to Audit.
|
||||
>
|
||||
> For more information, see [Attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
For more information, see [Attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Add Scope Tags as required, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Select groups to include and assign to test group, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. Review the details, then select **Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
10. View the policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Web Protection
|
||||
|
||||
@ -228,37 +246,44 @@ different types of Endpoint security policies.
|
||||
|
||||
4. Select **Windows 10 and Later – Web protection > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Enter a name and description, then select **Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
6. In the **Configuration settings page**: Set the configurations you require for
|
||||
Web Protection, then select **Next**.
|
||||
|
||||
> [!NOTE]
|
||||
> We are configuring Web Protection to Block.
|
||||
>
|
||||
> For more information, see [Web Protection](web-protection-overview.md).
|
||||
|
||||
For more information, see [Web Protection](web-protection-overview.md).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
7. Add **Scope Tags as required > Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
8. Select **Assign to test group > Next**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
9. Select **Review and Create > Create**.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
10. View the policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Validate configuration settings
|
||||
|
||||
@ -275,26 +300,31 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
1. Open the MEM portal and navigate to the relevant policy as shown in the
|
||||
steps above. The following example shows the next generation protection settings.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
2. Select the **Configuration Policy** to view the policy status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. Select **Device Status** to see the status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
4. Select **User Status** to see the status.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. Select **Per-setting status** to see the status.
|
||||
|
||||
>[!TIP]
|
||||
>This view is very useful to identify any settings that conflict with another policy.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Endpoint detection and response
|
||||
|
||||
@ -302,33 +332,38 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
1. Before applying the configuration, the Microsoft Defender ATP
|
||||
Protection service should not be started.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
2. After the configuration has been applied, the Microsoft Defender ATP
|
||||
Protection Service should be started.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
3. After the services are running on the device, the device appears in Microsoft
|
||||
Defender Security Center.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Next-generation protection
|
||||
|
||||
1. Before applying the policy on a test device, you should be able to manually
|
||||
manage the settings as shown below.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
2. After the policy has been applied, you should not be able to manually manage
|
||||
the settings.
|
||||
|
||||
> [!NOTE]
|
||||
> In the following image **Turn on cloud-delivered protection** and
|
||||
**Turn on real-time protection** are being shown as managed.
|
||||
> **Turn on real-time protection** are being shown as managed.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
### Attack Surface Reduction – Attack surface reduction rules
|
||||
|
||||
@ -337,11 +372,11 @@ To confirm that the configuration policy has been applied to your test device, f
|
||||
|
||||
2. This should respond with the following lines with no content:
|
||||
|
||||
AttackSurfaceReductionOnlyExclusions:
|
||||
|
||||
AttackSurfaceReductionRules_Actions:
|
||||
|
||||
AttackSurfaceReductionRules_Ids:
|
||||
> AttackSurfaceReductionOnlyExclusions:
|
||||
>
|
||||
> AttackSurfaceReductionRules_Actions:
|
||||
>
|
||||
> AttackSurfaceReductionRules_Ids:
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user