diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 006a4bbd17..340a768d75 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -374,6 +374,22 @@ "build_entry_point": "docs", "template_folder": "_themes", "version": 0 + }, + { + "docset_name": "bcs", + "build_source_folder": "bcs", + "build_output_subfolder": "bcs", + "locale": "en-us", + "monikers": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes", + "version": 0 } ], "notification_subscribers": [ @@ -386,7 +402,6 @@ "git_repository_branch_open_to_public_contributors": "master", "skip_source_output_uploading": false, "need_preview_pull_request": true, - "enable_incremental_build": true, "dependent_repositories": [ { "path_to_root": "_themes.pdf", @@ -402,9 +417,15 @@ } ], "branch_target_mapping": { - "live": ["Publish","Pdf"], - "master": ["Publish", "Pdf"] - }, + "live": [ + "Publish", + "Pdf" + ], + "master": [ + "Publish", + "Pdf" + ] + }, "need_generate_pdf_url_template": true, "Targets": { "Pdf": { diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6255425a69..024db75e72 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -512,17 +512,17 @@ }, { "source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-analytics-identify-apps", +"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-release-notes.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-analytics-requirements", +"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-analytics-additional-insights", +"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", "redirect_document_id": true }, { diff --git a/bcs/TOC.md b/bcs/TOC.md new file mode 100644 index 0000000000..06913f7aef --- /dev/null +++ b/bcs/TOC.md @@ -0,0 +1 @@ +# [Index](index.md) \ No newline at end of file diff --git a/bcs/docfx.json b/bcs/docfx.json new file mode 100644 index 0000000000..9901c08bd0 --- /dev/null +++ b/bcs/docfx.json @@ -0,0 +1,37 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "README.md", + "LICENSE", + "LICENSE-CODE", + "ThirdPartyNotices" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "**/includes/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": {}, + "fileMetadata": {}, + "template": [], + "dest": "bcs" + } +} \ No newline at end of file diff --git a/bcs/index.md b/bcs/index.md new file mode 100644 index 0000000000..867e2c8492 --- /dev/null +++ b/bcs/index.md @@ -0,0 +1 @@ +# Placeholder \ No newline at end of file diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 1c6e2264ab..9ee05419db 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -1,5 +1,5 @@ # [Microsoft HoloLens](index.md) -## [HoloLens in the enterprise: requirements](hololens-requirements.md) +## [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md) ## [Set up HoloLens](hololens-setup.md) ## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) ## [Enroll HoloLens in MDM](hololens-enroll-mdm.md) diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md index 8d0e2e7d6f..757d5d4376 100644 --- a/devices/hololens/change-history-hololens.md +++ b/devices/hololens/change-history-hololens.md @@ -14,6 +14,12 @@ localizationpriority: medium This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md). +## May 2017 + +| New or changed topic | Description | +| --- | --- | +| [Microsoft HoloLens in the enterprise: requirements](hololens-requirements.md) | Changed title to **Microsoft HoloLens in the enterprise: requirements and FAQ**, added questions and answers in new [FAQ section](hololens-requirements.md#faq-for-hololens) | + ## January 2017 | New or changed topic | Description | diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md index 39ce7ed68c..e9b51e6b8d 100644 --- a/devices/hololens/hololens-enroll-mdm.md +++ b/devices/hololens/hololens-enroll-mdm.md @@ -11,10 +11,10 @@ localizationpriority: medium # Enroll HoloLens in MDM -You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft Intune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. +You can manage multiple Microsoft HoloLens devices simultaneously using solutions like Microsoft Intune. You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens) and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies). >[!NOTE] ->Mobile device management (MDM) for the Development edition of HoloLens does not include VPN, BitLocker, or kiosk mode. Those features are only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md). +>Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md). ## Requirements diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md index 2e97949640..53f90a2f31 100644 --- a/devices/hololens/hololens-provisioning.md +++ b/devices/hololens/hololens-provisioning.md @@ -111,7 +111,7 @@ In Windows ICD, when you create a provisioning package for Windows Holographic, | **Certificates** | Deploy a certificate to HoloLens. | | **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens. | | **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md) | -| **Policies** | Allow or prevent developer mode on HoloLens. | +| **Policies** | Allow or prevent developer mode on HoloLens. [Policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies) | >[!NOTE] >App installation (**UniversalAppInstall**) using a provisioning package is not currently supported for HoloLens. @@ -119,3 +119,6 @@ In Windows ICD, when you create a provisioning package for Windows Holographic, + + + diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 400e3d6d3b..d364082e8d 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -1,6 +1,6 @@ --- -title: HoloLens in the enterprise requirements (HoloLens) -description: Requirements for general use, Wi-Fi, and device management for HoloLens in the enterprise. +title: HoloLens in the enterprise requirements and FAQ (HoloLens) +description: Requirements and FAQ for general use, Wi-Fi, and device management for HoloLens in the enterprise. ms.prod: w10 ms.mktglfcycl: manage ms.pagetype: hololens, devices @@ -9,11 +9,13 @@ author: jdeckerms localizationpriority: medium --- -# Microsoft HoloLens in the enterprise: requirements +# Microsoft HoloLens in the enterprise: requirements and FAQ When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/mixed-reality/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below. -## General use +## Requirements + +### General use - Microsoft account or Azure Active Directory (Azure AD) account - Wi-Fi network to set up HoloLens @@ -21,7 +23,7 @@ When you develop for HoloLens, there are [system requirements and tools](https:/ >After you set up HoloLens, you can use it offline [with some limitations](https://support.microsoft.com/help/12645/hololens-use-hololens-offline). -## Supported wireless network EAP methods +### Supported wireless network EAP methods - PEAP-MS-CHAPv2 - PEAP-TLS - TLS @@ -31,16 +33,36 @@ When you develop for HoloLens, there are [system requirements and tools](https:/ - TTLS-PAP - TTLS-TLS -## Device management +### Device management - Users have Azure AD accounts with [Intune license assigned](https://docs.microsoft.com/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune-step-4) - Wi-Fi network - Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs -## Upgrade to Windows Holographic for Business +### Upgrade to Windows Holographic for Business - HoloLens Enterprise license XML file +## FAQ for HoloLens +#### Is Windows Hello for Business supported on HoloLens? + +Hello for Business (using a PIN to sign in) is supported for HoloLens. It must be configured [using MDM](hololens-enroll-mdm.md). + +#### Does the type of account change the sign-in behavior? + +Yes, the behavior for the type of account impacts the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type. + +- Microsoft account: signs in automatically +- Local account: always asks for password, not configurable by Settings +- Azure AD: asks for password by default; configurable by Settings to no longer ask for password. + +>[!NOTE] +>Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is respected only when the device goes into StandBy. + + +#### How do I remove a HoloLens device from the Intune dashboard? + +You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. ## Related resources diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index f385bbbcd2..a07b93cce8 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -15,12 +15,12 @@ author: trudyha - Windows 10 -When you sign up for a [Minecraft: Education Edition](http://education.minecraft.net) trial, or purchase a [Minecraft: Education Edition](http://education.minecraft.net) subscription. Minecraft will be added to the inventory in your Windows Store for Business, a private version of Windows Store associated with your Azure Active Directory (Azure AD) tenant. Your Store for Business is only displayed to members of your organization. +When you sign up for a [Minecraft: Education Edition](http://education.minecraft.net) trial, or purchase a [Minecraft: Education Edition](http://education.minecraft.net) subscription. Minecraft will be added to the inventory in your Microsoft Store for Education which is associated with your Azure Active Directory (Azure AD) tenant. Your Microsoft Store for Education is only displayed to members of your organization. >[!Note] >If you don't have an Azure AD or Office 365 tenant, you can set up a free Office 365 Education subscription when you request Minecraft: Education Edition. For more information see [Office 365 Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). -## Add Minecraft to your Windows Store for Business +## Add Minecraft to your Windows Store for Education You can start with the Minecraft: Education Edition trial to get individual copies of the app. For more information, see [Minecraft: Education Edition - direct purchase](#individual-copies). @@ -36,40 +36,36 @@ If you’ve been approved and are part of the Enrollment for Education Solutions -3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. +3. Select **Get the app**. This will take you to the Microsoft Store for Education to download the app. You will also receive an email with instructions and a link to the Store. -4. Sign in to Windows Store for Business with your email address. +4. Sign in to Microsoft Store for Education with your email address. -5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. +5. Read and accept the Microsoft Store for Education Service Agreement, and then select **Next**. -6. **Minecraft: Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft: Education Edition** in your Store inventory. +6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Store inventory. -Now that the app is in your Store for Business inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft). +Now that the app is in your Microsoft Store for Education inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft). If you need additional licenses for **Minecraft: Education Edition**, see [Purchase additional licenses](https://technet.microsoft.com/edu/windows/education-scenarios-store-for-business#purchase-additional-licenses). ### Minecraft: Education Edition - volume licensing - Qualified education institutions can purchase Minecraft: Education Edition licenses through their Microsoft channel partner. Schools need to be part of the Enrollment for Education Solutions (EES) volume licensing program. Educational institutions should work with their channel partner to determine which Minecraft: Education Edition licensing offer is best for their institution. The process looks like this: -- Your channel partner will submit and process your volume license order, your licenses will be shown on [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx), and the licenses will be available in your [Windows Store for Business](https://www.microsoft.com/business-store) inventory. -- You’ll receive an email with a link to Windows Store for Business. -- Sign in to [Windows Store for Business](https://www.microsoft.com/business-store) to distribute and manage the Minecraft: Education Edition licenses. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft) +- Your channel partner will submit and process your volume license order, your licenses will be shown on [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx), and the licenses will be available in your [Microsoft Store for Education](https://www.microsoft.com/business-store) inventory. +- You’ll receive an email with a link to Microsoft Store for Education. +- Sign in to [Windows Store for Education](https://educationstore.microsoft.com) to distribute and manage the Minecraft: Education Edition licenses. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft) ## Minecraft: Education Edition payment options You can pay for Minecraft: Education Edition with a debit or credit card, or with an invoice. - ### Debit or credit cards - During the purchase, click **Get started! Add a way to pay.** Provide the info needed for your debit or credit card. ### Invoices - Invoices are now a supported payment method for Minecraft: Education Edition. There are a few requirements: - Admins only (not supported for Teachers) - $500 invoice minimum for your initial purchase @@ -87,12 +83,13 @@ Invoices are now a supported payment method for Minecraft: Education Edition. Th ### Find your invoice -After you've finished the purchase, you can find your invoice by checking **Minecraft: Education Edition** in your **Inventory**. +After you've finished the purchase, you can find your invoice by checking **Minecraft: Education Edition** in your **Apps & software**. -> **Note**: After you complete a purchase, it can take up to twenty-four hours for the app to appear in **Inventory**. +> [!NOTE] +> After you complete a purchase, it can take up to twenty-four hours for the app to appear in **Apps & software**. **To view your invoice** -1. In Windows Store for Business, click **Manage** and then click **Inventory**. +1. In Microsoft Store for Education, click **Manage** and then click **Apps & software**. 2. Click **Minecraft: Education Edition** in the list of apps. 3. On **Minecraft: Education Edition**, click **View Bills**. @@ -104,10 +101,8 @@ After you've finished the purchase, you can find your invoice by checking **Mine The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. - ## Distribute Minecraft - -After Minecraft: Education Edition is added to your Windows Store for Business inventory, you have three options: +After Minecraft: Education Edition is added to your Microsoft Store for Education inventory, you have three options: - You can install the app on your PC. - You can assign the app to others. @@ -131,10 +126,10 @@ For Minecraft: Education Edition, you can use auto assign subscription to contro **How to turn off automatic subscription assignment** ->[!Note] ->The version of the Minecraft: Education Edition page in the Store for Business will be different depending on which Store for Business flight you are using. +> [!Note] +> The version of the Minecraft: Education Edition page in the Microsoft Store will be different depending on which Microsoft Store for Education flight you are using. -1. Sign in to Microsoft Store for Business +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com) 2. Click Manage. You'll see Minecraft: Education Edition product page. @@ -150,7 +145,7 @@ For Minecraft: Education Edition, you can use auto assign subscription to contro ### Install for me You can install the app on your PC. This gives you a chance to test the app and know how you might help others in your organization use the app. -1. Sign in to Microsoft Store for Business. +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) @@ -162,7 +157,7 @@ Enter email addresses for your students, and each student will get an email with **To assign to others** -1. Sign in to Windows Store for Business. +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) @@ -234,7 +229,7 @@ You'll download a .zip file, extract the files, and then use one of the files to - ## Learn more -[Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md)
-Learn about overall Windows Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history. - -[Roles and permissions in Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business) - -[Troubleshoot Windows Store for Business](https://technet.microsoft.com/itpro/windows/manage/troubleshoot-windows-store-for-business) +[Working with Microsoft Store for Education – education scenarios](education-scenarios-store-for-business.md)
+Learn about overall Microsoft Store for Education management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history. +[Roles and permissions in Microsoft Store for Business and Education](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business) +[Troubleshoot Microsoft Store for Business and Education](https://technet.microsoft.com/itpro/windows/manage/troubleshoot-windows-store-for-business) ## Related topics [Get Minecraft: Education Edition](get-minecraft-for-education.md) - [For teachers get Minecraft: Education Edition](teacher-get-minecraft.md) diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index e5ce0def1b..36de86549d 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -17,7 +17,7 @@ author: trudyha Learn how teachers can get and distribute Minecraft: Education Edition. -## Add Minecraft to your Windows Store for Business +## Add Minecraft to your Microsoft Store for Education 1. Go to [http://education.minecraft.net/](http://education.minecraft.net/) and select **GET STARTED**. @@ -27,15 +27,15 @@ Learn how teachers can get and distribute Minecraft: Education Edition. -3. Select **Get the app**. This will take you to the Windows Store for Business to download the app. You will also receive an email with instructions and a link to the Store. +3. Select **Get the app**. This will take you to Microsoft Store for Ecucation to download the app. You will also receive an email with instructions and a link to the Store. -4. Sign in to Windows Store for Business with your email address. +4. Sign in to Microsoft Store for Education with your email address. -5. Read and accept the Windows Store for Business Service Agreement, and then select **Next**. +5. Read and accept the Microsoft Store for Business and Education Service Agreement, and then select **Next**. -6. **Minecraft: Education Edition** opens in the Windows Store for Business. Select **Get the app**. This places **Minecraft: Education Edition** in your Windows Store for Business inventory. +6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Microsoft Store inventory. ![Get Minecraft app in Store](images/minecraft-get-the-app.png) @@ -43,7 +43,7 @@ If you need additional licenses for **Minecraft: Education Edition**, see [Purch ## Distribute Minecraft -After Minecraft: Education Edition is added to your Windows Store for Business inventory, you have three options: +After Minecraft: Education Edition is added to your Microsoft Store for Education inventory, you have three options: - You can install the app on your PC. - You can assign the app to others. @@ -54,7 +54,7 @@ After Minecraft: Education Edition is added to your Windows Store for Business i ### Install for me You can install the app on your PC. This gives you a chance to work with the app before using it with your students. -1. Sign in to Windows Store for Business. +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) @@ -65,7 +65,7 @@ You can install the app on your PC. This gives you a chance to work with the app Enter email addresses for your students, and each student will get an email with a link to install the app. This option is best for older, more tech-savvy students who will always use the same PC at school. **To assign to others** -1. Sign in to Windows Store for Business. +1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) @@ -95,7 +95,7 @@ Students will receive an email with a link that will install the app on their PC ![Windows Store app showing access to My Library](images/minecraft-private-store.png) - When students click **My Libarary** they'll find apps assigned to them. + When students click **My Library** they'll find apps assigned to them. ![My Library for example student](images/minecraft-my-library.png) @@ -131,7 +131,6 @@ You'll download a .zip file, extract the files, and then use one of the files to ![Windows Store app showing access to My Library](images/mc-dnld-others-teacher.png) - 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. 4. **Install app**. Use the USB drive to copy the Minecraft folder to each Windows 10 PC where you want to install Minecraft: Education Edition. Open Minecraft: Education Edition folder, right-click **InstallMinecraftEducationEdition.bat** and click **Run as administrator**. @@ -155,11 +154,9 @@ If you are still having trouble installing the app, you can get more help on our ## Related topics -[Working with Windows Store for Business – education scenarios](education-scenarios-store-for-business.md)
-Learn about overall Windows Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history. - +[Working with Microsoft Store for Education](education-scenarios-store-for-business.md)
+Learn about overall Microsoft Store for Business management: manage settings, shop for apps, distribute apps, manage inventory, and manage order history. [Get Minecraft: Education Edition](get-minecraft-for-education.md) - [For IT admins: get Minecraft: Education Edition](school-get-minecraft.md) diff --git a/store-for-business/manage-users-and-groups-windows-store-for-business.md b/store-for-business/manage-users-and-groups-windows-store-for-business.md index 83baed4cea..1b56584329 100644 --- a/store-for-business/manage-users-and-groups-windows-store-for-business.md +++ b/store-for-business/manage-users-and-groups-windows-store-for-business.md @@ -21,7 +21,7 @@ localizationpriority: high Microsoft Store for Business and Education manages permissions with a set of roles. Currently, you can [assign these roles to individuals in your organization](roles-and-permissions-windows-store-for-business.md), but not to groups. ## Why Azure AD accounts? -For organizations planning to use the private store feature with Store for Business, we recommend that you also configure cloud domain join. This provides a seamless integration between the identity your admin and employees will use to sign in to Windows and the Store for Business. +For organizations planning to use the private store feature with Store for Business, we recommend that you also configure cloud domain join. This provides a seamless integration between the identity your admin and employees will use to sign in to Windows and the Microsoft Store for Business. Azure AD is an Azure service that provides identity and access management capabilities using the cloud. It is primarily designed to provide this service for cloud- or web-based applications that need to access your local Active Directory information. Azure AD identity and access management includes: diff --git a/store-for-business/troubleshoot-windows-store-for-business.md b/store-for-business/troubleshoot-windows-store-for-business.md index 5ea7623579..b12f94afae 100644 --- a/store-for-business/troubleshoot-windows-store-for-business.md +++ b/store-for-business/troubleshoot-windows-store-for-business.md @@ -48,13 +48,9 @@ The private store for your organization is a page in the Windows Store app that ## Still having trouble? -If you are still having trouble using WSfB or installing the app, you can get more help on our [Support page](https://go.microsoft.com/fwlink/?LinkID=799386). - -  - -  - - - - +If you are still having trouble using Microsoft Store or installing an app, Admins can sign in and look for topics on our **Support** page. + +**To view Support page**  +1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) +2. Click **Manage**, and then click **Support**. \ No newline at end of file diff --git a/store-for-business/update-windows-store-for-business-account-settings.md b/store-for-business/update-windows-store-for-business-account-settings.md index 56aaa46e30..29d1144790 100644 --- a/store-for-business/update-windows-store-for-business-account-settings.md +++ b/store-for-business/update-windows-store-for-business-account-settings.md @@ -35,7 +35,7 @@ We need an email address in case we need to contact you about your Microsoft Sto 2. Click **Manage**, click **Payments & billing**, and then click **Edit**. ## Organization tax information -Taxes for Windows Store for Business purchases are determined by your business address. Businesses in these countries can provide their VAT number or local equivalent: +Taxes for Microsoft Store for Business purchases are determined by your business address. Businesses in these countries can provide their VAT number or local equivalent: - Austria - Belgium - Croatia @@ -99,7 +99,7 @@ For example:
($1.29 X .095) X 100 = $12.25 ## Payment options -You can purchase apps from the Windows Store for Business using your credit card. You can enter your credit card information on Account Information, or when you purchase an app. We currently accept these credit cards: +You can purchase apps from the Microsoft Store for Business using your credit card. You can enter your credit card information on Account Information, or when you purchase an app. We currently accept these credit cards: 1. VISA 2. MasterCard 3. Discover @@ -136,7 +136,7 @@ Once you click **Next**, the information you provided will be validated with a Offline licensing is a new licensing option for Windows 10. With offline licenses, organizations can cache apps and their licenses to deploy within their network. ISVs or devs can opt-in their apps for offline licensing when they submit them to the developer center. Only apps that are opted in to offline licensing will show that they are available for offline licensing in Store for Business. This model means organizations can deploy apps when users or devices do not have connectivity to the Store. For more information on the Store for Business licensing model, see [licensing model](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model). -Admins can decide whether or not offline licenses are shown for apps in Windows Store for Business. +Admins can decide whether or not offline licenses are shown for apps in Microsoft Store. **To set offline license visibility** diff --git a/windows/access-protection/TOC.md b/windows/access-protection/TOC.md index 16b848c11f..d9e141960f 100644 --- a/windows/access-protection/TOC.md +++ b/windows/access-protection/TOC.md @@ -47,7 +47,6 @@ #### [User Account Control security policy settings](user-account-control\user-account-control-security-policy-settings.md) #### [User Account Control Group Policy and registry key settings](user-account-control\user-account-control-group-policy-and-registry-key-settings.md) -### [Virtual Smart Cards](virtual-smart-cards\virtual-smart-card-overview.md) ### [Virtual Smart Cards](virtual-smart-cards\virtual-smart-card-overview.md) #### [Understanding and Evaluating Virtual Smart Cards](virtual-smart-cards\virtual-smart-card-understanding-and-evaluating.md) ##### [Get Started with Virtual Smart Cards: Walkthrough Guide](virtual-smart-cards\virtual-smart-card-get-started.md) diff --git a/windows/access-protection/credential-guard/credential-guard-known-issues.md b/windows/access-protection/credential-guard/credential-guard-known-issues.md index b9cacf0bc7..a3780e1d3f 100644 --- a/windows/access-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/access-protection/credential-guard/credential-guard-known-issues.md @@ -26,26 +26,29 @@ See also Knowledge Base articles [KB4015219](https://support.microsoft.com/en-us [KB4015221](https://support.microsoft.com/en-us/help/4015221/windows-10-update-kb4015221) The following issue is under investigation. For available workarounds, see the following Knowledge Base article: -- [Installing AppSense Environment Manager on Windows 10 machines causes LsaIso.exe to exhibit high CPU usage when Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) * +- [Installing AppSense Environment Manager on Windows 10 machines causes LSAiso.exe to exhibit high CPU usage when Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) * [1] - *Registration required to access this article. + *Registration required to access this article. + + [1] For further technical information on LSAiso.exe, see this MSDN article: [Isolated User Mode (IUM) Processes](https://msdn.microsoft.com/library/windows/desktop/mt809132(v=vs.85).aspx) + +The following issue affects Cisco AnyConnect Secure Mobility Client: - [Blue screen on Windows 10 computers running Device Guard and Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692)** - **Registration required to access this article. +**Registration required to access this article. -Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled Windows 10 clients to exhibit high CPU usage. For further information, see the following Knowledge Base articles: +Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled Windows 10 clients to exhibit high CPU usage. For further information, see the following Knowledge Base article: - KB88869: [Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) +The following issue is under investigation: - Windows 10 machines exhibit high CPU usage with Citrix applications installed when Credential Guard is enabled. - Microsoft is currently working with Citrix to investigate this issue. - - ## Vendor support +See the following article on Citrix support for Secure Boot: - [Citrix Support for Secure Boot](https://www.citrix.com/blogs/2016/12/08/windows-server-2016-hyper-v-secure-boot-support-now-available-in-xenapp-7-12/) Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions: diff --git a/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 03a95580ef..713019ca33 100644 --- a/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -25,7 +25,7 @@ If you want to minimize connections from Windows to Microsoft services, or confi You can configure telemetry at the Security level, turn off Windows Defender telemetry and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. -To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. You should not extract this package to the the windows\\system32 folder because it will not apply correctly. Applying this baseline is equivalent to applying the Windows 10 steps covered in this article. +To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887). This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state. Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure should you've chosen the right settings configuration for your environment before applying. You should not extract this package to the windows\\system32 folder because it will not apply correctly. Applying this baseline is equivalent to applying the Windows 10 steps covered in this article. We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. @@ -287,15 +287,19 @@ You can prevent Windows from setting the time automatically. -or- +- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. + +After that, configure the following: + - Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Configure Windows NTP Client** + + > [!NOTE] + > This is only available on Windows 10, version 1703 and later. -or - -- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient!Enabled** to 0 (zero). +- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient!Enabled** and set it to 0 (zero). - -or- - -- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**. ### 4. Device metadata retrieval @@ -392,7 +396,6 @@ Use Group Policy to manage settings for Internet Explorer. You can find the Int | Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites.
Default: Enabled
You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.| | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the address bar.
Default: Enabled| | Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the address bar.
Default: Disabled
You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.| -| Disable Periodic Check for Internet Explorer software updates| Choose whether Internet Explorer periodically checks for a new version.
Default: Enabled | | Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer.
Default: Disabled| | Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer.
Default: Disabled | @@ -403,7 +406,6 @@ Alternatively, you could use the registry to set the Group Policies. | Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites!Enabled
REG_DWORD: 0| | Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AllowServicePoweredQSA
REG_DWORD: 0| | Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Explorer\\AutoComplete!AutoSuggest
REG_SZ: **No** | -| Disable Periodic Check for Internet Explorer software updates| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Infodelivery\\Restrictions!NoUpdateCheck
REG_DWORD: 1 | | Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation!PolicyDisableGeolocation
REG_DWORD: 1 | | Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\ Internet Explorer\\PhishingFilter!EnabledV9
REG_DWORD: 0 | @@ -510,8 +512,8 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g | Configure search suggestions in Address bar | Choose whether the address bar shows search suggestions.
Default: Enabled | | Configure Windows Defender SmartScreen Filter (Windows 10, version 1703)
Configure SmartScreen Filter (Windows Server 2016) | Choose whether Windows Defender SmartScreen is turned on or off.
Default: Enabled | | Allow web content on New Tab page | Choose whether a new tab page appears.
Default: Enabled | -| Configure Start pages | Choose the Start page for domain-joined devices.
Set this to **about:blank** | -| Prevent the First Run webpage from opening pages | Choose whether employees see the First Run webpage.
Default: Enabled | +| Configure Start pages | Choose the Start page for domain-joined devices.
Set this to **\** | +| Prevent the First Run webpage from opening on Microsoft Edge | Choose whether employees see the First Run webpage.
Default: Disabled | The Windows 10, version 1511 Microsoft Edge Group Policy names are: diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index 0890fdadbc..9a54b72f77 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -19,7 +19,7 @@ localizationpriority: high In your organization, you might have different configuration requirements for devices that you manage. You can create separate provisioning packages for each group of devices in your organization that have different requirements. Or, you can create a multivariant provisioning package, a single provisioning package that can work for multiple conditions. For example, in a single provisioning package, you can define one set of customization settings that will apply to devices set up for French and a different set of customization settings for devices set up for Japanese. -To provision multivariant settings, you use Windows Imaging and Configuration Designer (ICD) to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices. +To provision multivariant settings, you use Windows Configuration Designer to create a provisioning package that contains all of the customization settings that you want to apply to any of your devices. Next, you manually edit the .XML file for that project to define each set of devices (a **Target**). For each **Target**, you specify at least one **Condition** with a value, which identifies the devices to receive the configuration. Finally, for each **Target**, you provide the customization settings to be applied to those devices. Let's begin by learning how to define a **Target**. @@ -258,7 +258,7 @@ Follow these steps to create a provisioning package with multivariant capabiliti 6. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. -7. Use the [Windows ICD command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. +7. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. For example: diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 73fce9589a..babe4c7aa6 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -1,44 +1,176 @@ -# [Deploy Windows 10](index.md) -## [What's new in Windows 10 deployment](deploy-whats-new.md) -## [Plan for Windows 10 deployment](planning/index.md) -### [Windows 10 Enterprise FAQ for IT Pros](planning/windows-10-enterprise-faq-itpro.md) -### [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) -### [Windows 10 compatibility](planning/windows-10-compatibility.md) -### [Windows 10 infrastructure requirements](planning/windows-10-infrastructure-requirements.md) -### [Windows To Go: feature overview](planning/windows-to-go-overview.md) -#### [Best practice recommendations for Windows To Go](planning/best-practice-recommendations-for-windows-to-go.md) -#### [Deployment considerations for Windows To Go](planning/deployment-considerations-for-windows-to-go.md) -#### [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) -#### [Security and data protection considerations for Windows To Go](planning/security-and-data-protection-considerations-for-windows-to-go.md) -#### [Windows To Go: frequently asked questions](planning/windows-to-go-frequently-asked-questions.md) -### [Application Compatibility Toolkit (ACT) Technical Reference](planning/act-technical-reference.md) -#### [SUA User's Guide](planning/sua-users-guide.md) -##### [Using the SUA Wizard](planning/using-the-sua-wizard.md) -##### [Using the SUA Tool](planning/using-the-sua-tool.md) -###### [Tabs on the SUA Tool Interface](planning/tabs-on-the-sua-tool-interface.md) -###### [Showing Messages Generated by the SUA Tool](planning/showing-messages-generated-by-the-sua-tool.md) -###### [Applying Filters to Data in the SUA Tool](planning/applying-filters-to-data-in-the-sua-tool.md) -###### [Fixing Applications by Using the SUA Tool](planning/fixing-applications-by-using-the-sua-tool.md) -#### [Compatibility Administrator User's Guide](planning/compatibility-administrator-users-guide.md) -##### [Using the Compatibility Administrator Tool](planning/using-the-compatibility-administrator-tool.md) -###### [Available Data Types and Operators in Compatibility Administrator](planning/available-data-types-and-operators-in-compatibility-administrator.md) -###### [Searching for Fixed Applications in Compatibility Administrator](planning/searching-for-fixed-applications-in-compatibility-administrator.md) -###### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) -###### [Creating a Custom Compatibility Fix in Compatibility Administrator](planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md) -###### [Creating a Custom Compatibility Mode in Compatibility Administrator](planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md) -###### [Creating an AppHelp Message in Compatibility Administrator](planning/creating-an-apphelp-message-in-compatibility-administrator.md) -###### [Viewing the Events Screen in Compatibility Administrator](planning/viewing-the-events-screen-in-compatibility-administrator.md) -###### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) -###### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) -##### [Managing Application-Compatibility Fixes and Custom Fix Databases](planning/managing-application-compatibility-fixes-and-custom-fix-databases.md) -###### [Understanding and Using Compatibility Fixes](planning/understanding-and-using-compatibility-fixes.md) -###### [Compatibility Fix Database Management Strategies and Deployment](planning/compatibility-fix-database-management-strategies-and-deployment.md) -###### [Testing Your Application Mitigation Packages](planning/testing-your-application-mitigation-packages.md) -##### [Using the Sdbinst.exe Command-Line Tool](planning/using-the-sdbinstexe-command-line-tool.md) -#### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) -### [Change history for Plan for Windows 10 deployment](planning/change-history-for-plan-for-windows-10-deployment.md) -## [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) -## Upgrade Windows +# [Deploy, Upgrade and Update Windows 10](index.md) + +## Deploy Windows 10 +### [What's new in Windows 10 deployment](deploy-whats-new.md) + +### [Plan for Windows 10 deployment](planning/index.md) +#### [Windows 10 Enterprise FAQ for IT Pros](planning/windows-10-enterprise-faq-itpro.md) +#### [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md) +#### [Windows 10 compatibility](planning/windows-10-compatibility.md) +#### [Windows 10 infrastructure requirements](planning/windows-10-infrastructure-requirements.md) +#### [Windows To Go: feature overview](planning/windows-to-go-overview.md) +##### [Best practice recommendations for Windows To Go](planning/best-practice-recommendations-for-windows-to-go.md) +##### [Deployment considerations for Windows To Go](planning/deployment-considerations-for-windows-to-go.md) +##### [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) +##### [Security and data protection considerations for Windows To Go](planning/security-and-data-protection-considerations-for-windows-to-go.md) +##### [Windows To Go: frequently asked questions](planning/windows-to-go-frequently-asked-questions.md) +#### [Application Compatibility Toolkit (ACT) Technical Reference](planning/act-technical-reference.md) +##### [SUA User's Guide](planning/sua-users-guide.md) +###### [Using the SUA Wizard](planning/using-the-sua-wizard.md) +###### [Using the SUA Tool](planning/using-the-sua-tool.md) +####### [Tabs on the SUA Tool Interface](planning/tabs-on-the-sua-tool-interface.md) +####### [Showing Messages Generated by the SUA Tool](planning/showing-messages-generated-by-the-sua-tool.md) +####### [Applying Filters to Data in the SUA Tool](planning/applying-filters-to-data-in-the-sua-tool.md) +####### [Fixing Applications by Using the SUA Tool](planning/fixing-applications-by-using-the-sua-tool.md) +##### [Compatibility Administrator User's Guide](planning/compatibility-administrator-users-guide.md) +###### [Using the Compatibility Administrator Tool](planning/using-the-compatibility-administrator-tool.md) +####### [Available Data Types and Operators in Compatibility Administrator](planning/available-data-types-and-operators-in-compatibility-administrator.md) +####### [Searching for Fixed Applications in Compatibility Administrator](planning/searching-for-fixed-applications-in-compatibility-administrator.md) +####### [Searching for Installed Compatibility Fixes with the Query Tool in Compatibility Administrator](planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md) +####### [Creating a Custom Compatibility Fix in Compatibility Administrator](planning/creating-a-custom-compatibility-fix-in-compatibility-administrator.md) +####### [Creating a Custom Compatibility Mode in Compatibility Administrator](planning/creating-a-custom-compatibility-mode-in-compatibility-administrator.md) +####### [Creating an AppHelp Message in Compatibility Administrator](planning/creating-an-apphelp-message-in-compatibility-administrator.md) +####### [Viewing the Events Screen in Compatibility Administrator](planning/viewing-the-events-screen-in-compatibility-administrator.md) +####### [Enabling and Disabling Compatibility Fixes in Compatibility Administrator](planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md) +####### [Installing and Uninstalling Custom Compatibility Databases in Compatibility Administrator](planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md) +###### [Managing Application-Compatibility Fixes and Custom Fix Databases](planning/managing-application-compatibility-fixes-and-custom-fix-databases.md) +####### [Understanding and Using Compatibility Fixes](planning/understanding-and-using-compatibility-fixes.md) +####### [Compatibility Fix Database Management Strategies and Deployment](planning/compatibility-fix-database-management-strategies-and-deployment.md) +####### [Testing Your Application Mitigation Packages](planning/testing-your-application-mitigation-packages.md) +###### [Using the Sdbinst.exe Command-Line Tool](planning/using-the-sdbinstexe-command-line-tool.md) +##### [Compatibility Fixes for Windows 10, Windows 8, Windows 7, and Windows Vista](planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md) +#### [Change history for Plan for Windows 10 deployment](planning/change-history-for-plan-for-windows-10-deployment.md) + +### [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) + +### [Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md) +#### [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md) +#### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) +#### [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) +##### [Introduction to VAMT](volume-activation/introduction-vamt.md) +##### [Active Directory-Based Activation Overview](volume-activation/active-directory-based-activation-overview.md) +##### [Install and Configure VAMT](volume-activation/install-configure-vamt.md) +###### [VAMT Requirements](volume-activation/vamt-requirements.md) +###### [Install VAMT](volume-activation/install-vamt.md) +###### [Configure Client Computers](volume-activation/configure-client-computers-vamt.md) +##### [Add and Manage Products](volume-activation/add-manage-products-vamt.md) +###### [Add and Remove Computers](volume-activation/add-remove-computers-vamt.md) +###### [Update Product Status](volume-activation/update-product-status-vamt.md) +###### [Remove Products](volume-activation/remove-products-vamt.md) +##### [Manage Product Keys](volume-activation/manage-product-keys-vamt.md) +###### [Add and Remove a Product Key](volume-activation/add-remove-product-key-vamt.md) +###### [Install a Product Key](volume-activation/install-product-key-vamt.md) +###### [Install a KMS Client Key](volume-activation/install-kms-client-key-vamt.md) +##### [Manage Activations](volume-activation/manage-activations-vamt.md) +###### [Perform Online Activation](volume-activation/online-activation-vamt.md) +###### [Perform Proxy Activation](volume-activation/proxy-activation-vamt.md) +###### [Perform KMS Activation](volume-activation/kms-activation-vamt.md) +###### [Perform Local Reactivation](volume-activation/local-reactivation-vamt.md) +###### [Activate an Active Directory Forest Online](volume-activation/activate-forest-vamt.md) +###### [Activate by Proxy an Active Directory Forest](volume-activation/activate-forest-by-proxy-vamt.md) +##### [Manage VAMT Data](volume-activation/manage-vamt-data.md) +###### [Import and Export VAMT Data](volume-activation/import-export-vamt-data.md) +###### [Use VAMT in Windows PowerShell](volume-activation/use-vamt-in-windows-powershell.md) +##### [VAMT Step-by-Step Scenarios](volume-activation/vamt-step-by-step.md) +###### [Scenario 1: Online Activation](volume-activation/scenario-online-activation-vamt.md) +###### [Scenario 2: Proxy Activation](volume-activation/scenario-proxy-activation-vamt.md) +###### [Scenario 3: KMS Client Activation](volume-activation/scenario-kms-activation-vamt.md) +##### [VAMT Known Issues](volume-activation/vamt-known-issues.md) +#### [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) +##### [User State Migration Tool (USMT) Overview Topics](usmt/usmt-topics.md) +###### [User State Migration Tool (USMT) Overview](usmt/usmt-overview.md) +###### [Getting Started with the User State Migration Tool (USMT)](usmt/getting-started-with-the-user-state-migration-tool.md) +###### [Windows Upgrade and Migration Considerations](upgrade/windows-upgrade-and-migration-considerations.md) +##### [User State Migration Tool (USMT) How-to topics](usmt/usmt-how-to.md) +###### [Exclude Files and Settings](usmt/usmt-exclude-files-and-settings.md) +###### [Extract Files from a Compressed USMT Migration Store](usmt/usmt-extract-files-from-a-compressed-migration-store.md) +###### [Include Files and Settings](usmt/usmt-include-files-and-settings.md) +###### [Migrate Application Settings](usmt/migrate-application-settings.md) +###### [Migrate EFS Files and Certificates](usmt/usmt-migrate-efs-files-and-certificates.md) +###### [Migrate User Accounts](usmt/usmt-migrate-user-accounts.md) +###### [Reroute Files and Settings](usmt/usmt-reroute-files-and-settings.md) +###### [Verify the Condition of a Compressed Migration Store](usmt/verify-the-condition-of-a-compressed-migration-store.md) +##### [User State Migration Tool (USMT) Troubleshooting](usmt/usmt-troubleshooting.md) +###### [Common Issues](usmt/usmt-common-issues.md) +###### [Frequently Asked Questions](usmt/usmt-faq.md) +###### [Log Files](usmt/usmt-log-files.md) +###### [Return Codes](usmt/usmt-return-codes.md) +###### [USMT Resources](usmt/usmt-resources.md) +##### [User State Migration Toolkit (USMT) Reference](usmt/usmt-reference.md) +###### [USMT Requirements](usmt/usmt-requirements.md) +###### [USMT Best Practices](usmt/usmt-best-practices.md) +###### [How USMT Works](usmt/usmt-how-it-works.md) +###### [Plan Your Migration](usmt/usmt-plan-your-migration.md) +####### [Common Migration Scenarios](usmt/usmt-common-migration-scenarios.md) +####### [What Does USMT Migrate?](usmt/usmt-what-does-usmt-migrate.md) +####### [Choose a Migration Store Type](usmt/usmt-choose-migration-store-type.md) +######## [Migration Store Types Overview](usmt/migration-store-types-overview.md) +######## [Estimate Migration Store Size](usmt/usmt-estimate-migration-store-size.md) +######## [Hard-Link Migration Store](usmt/usmt-hard-link-migration-store.md) +######## [Migration Store Encryption](usmt/usmt-migration-store-encryption.md) +####### [Determine What to Migrate](usmt/usmt-determine-what-to-migrate.md) +######## [Identify Users](usmt/usmt-identify-users.md) +######## [Identify Applications Settings](usmt/usmt-identify-application-settings.md) +######## [Identify Operating System Settings](usmt/usmt-identify-operating-system-settings.md) +######## [Identify File Types, Files, and Folders](usmt/usmt-identify-file-types-files-and-folders.md) +####### [Test Your Migration](usmt/usmt-test-your-migration.md) +###### [User State Migration Tool (USMT) Command-line Syntax](usmt/usmt-command-line-syntax.md) +####### [ScanState Syntax](usmt/usmt-scanstate-syntax.md) +####### [LoadState Syntax](usmt/usmt-loadstate-syntax.md) +####### [UsmtUtils Syntax](usmt/usmt-utilities.md) +###### [USMT XML Reference](usmt/usmt-xml-reference.md) +####### [Understanding Migration XML Files](usmt/understanding-migration-xml-files.md) +####### [Config.xml File](usmt/usmt-configxml-file.md) +####### [Customize USMT XML Files](usmt/usmt-customize-xml-files.md) +####### [Custom XML Examples](usmt/usmt-custom-xml-examples.md) +####### [Conflicts and Precedence](usmt/usmt-conflicts-and-precedence.md) +####### [General Conventions](usmt/usmt-general-conventions.md) +####### [XML File Requirements](usmt/xml-file-requirements.md) +####### [Recognized Environment Variables](usmt/usmt-recognized-environment-variables.md) +####### [XML Elements Library](usmt/usmt-xml-elements-library.md) +###### [Offline Migration Reference](usmt/offline-migration-reference.md) + +### [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) +#### [Integrate Configuration Manager with MDT](deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) +#### [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +#### [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) +#### [Add a Windows 10 operating system image using Configuration Manager](deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md) +#### [Create an application to deploy with Windows 10 using Configuration Manager](deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) +#### [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) +#### [Create a task sequence with Configuration Manager and MDT](deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) +#### [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) +#### [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md) +#### [Monitor the Windows 10 deployment with Configuration Manager](deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md) +#### [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) +#### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) +#### [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) +#### [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) + +### [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) +#### [Get started with the Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md) +##### [Key features in MDT](deploy-windows-mdt/key-features-in-mdt.md) +##### [MDT Lite Touch components](deploy-windows-mdt/mdt-lite-touch-components.md) +##### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) +#### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) +#### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md) +#### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md) +#### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md) +#### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md) +#### [Perform an in-place upgrade to Windows 10 with MDT](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) +#### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md) +##### [Set up MDT for BitLocker](deploy-windows-mdt/set-up-mdt-for-bitlocker.md) +##### [Configure MDT deployment share rules](deploy-windows-mdt/configure-mdt-deployment-share-rules.md) +##### [Configure MDT for UserExit scripts](deploy-windows-mdt/configure-mdt-for-userexit-scripts.md) +##### [Simulate a Windows 10 deployment in a test environment](deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md) +##### [Use the MDT database to stage Windows 10 deployment information](deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md) +##### [Assign applications using roles in MDT](deploy-windows-mdt/assign-applications-using-roles-in-mdt.md) +##### [Use web services in MDT](deploy-windows-mdt/use-web-services-in-mdt.md) +##### [Use Orchestrator runbooks with MDT](deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md) +#### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) + +### [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) + +## Upgrade to Windows 10 ### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) ### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) ### [Deploy Windows To Go in your organization](deploy-windows-to-go.md) @@ -55,47 +187,8 @@ ##### [Step 3: Deploy Windows](upgrade/upgrade-readiness-deploy-windows.md) ##### [Additional insights](upgrade/upgrade-readiness-additional-insights.md) #### [Troubleshoot Upgrade Readiness](upgrade/troubleshoot-upgrade-readiness.md) -## [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) -### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) -### [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) -## [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -### [Get started with the Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md) -#### [Key features in MDT](deploy-windows-mdt/key-features-in-mdt.md) -#### [MDT Lite Touch components](deploy-windows-mdt/mdt-lite-touch-components.md) -#### [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) -### [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) -### [Deploy a Windows 10 image using MDT](deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md) -### [Build a distributed environment for Windows 10 deployment](deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md) -### [Refresh a Windows 7 computer with Windows 10](deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md) -### [Replace a Windows 7 computer with a Windows 10 computer](deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md) -### [Perform an in-place upgrade to Windows 10 with MDT](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) -### [Configure MDT settings](deploy-windows-mdt/configure-mdt-settings.md) -#### [Set up MDT for BitLocker](deploy-windows-mdt/set-up-mdt-for-bitlocker.md) -#### [Configure MDT deployment share rules](deploy-windows-mdt/configure-mdt-deployment-share-rules.md) -#### [Configure MDT for UserExit scripts](deploy-windows-mdt/configure-mdt-for-userexit-scripts.md) -#### [Simulate a Windows 10 deployment in a test environment](deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md) -#### [Use the MDT database to stage Windows 10 deployment information](deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md) -#### [Assign applications using roles in MDT](deploy-windows-mdt/assign-applications-using-roles-in-mdt.md) -#### [Use web services in MDT](deploy-windows-mdt/use-web-services-in-mdt.md) -#### [Use Orchestrator runbooks with MDT](deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md) -## [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) -### [Integrate Configuration Manager with MDT](deploy-windows-mdt/integrate-configuration-manager-with-mdt.md) -### [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) -### [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md) -### [Add a Windows 10 operating system image using Configuration Manager](deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager.md) -### [Create an application to deploy with Windows 10 using Configuration Manager](deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md) -### [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md) -### [Create a task sequence with Configuration Manager and MDT](deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md) -### [Finalize the operating system configuration for Windows 10 deployment with Configuration Manager](deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md) -### [Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager.md) -### [Monitor the Windows 10 deployment with Configuration Manager](deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager.md) -### [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md) -### [Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) -### [Perform an in-place upgrade to Windows 10 using Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) -## [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) -## [Convert MBR partition to GPT](mbr-to-gpt.md) -## [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) -## [Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) +### [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) + ## [Update Windows 10](update/index.md) ### [Quick guide to Windows as a service](update/waas-quick-start.md) ### [Overview of Windows as a service](update/waas-overview.md) @@ -117,11 +210,17 @@ ### [Deploy Windows 10 updates using Windows Server Update Services](update/waas-manage-updates-wsus.md) ### [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) ### [Manage device restarts after updates](update/waas-restart.md) +### [Manage additional Windows Update settings](update/waas-wu-settings.md) ### [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) #### [Windows Insider Program for Business using Azure Active Directory](update/waas-windows-insider-for-business-aad.md) #### [Windows Insider Program for Business Frequently Asked Questions](update/waas-windows-insider-for-business-faq.md) ### [Change history for Update Windows 10](update/change-history-for-update-windows-10.md) +## [Convert MBR partition to GPT](mbr-to-gpt.md) +## [Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) +## [Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) +## [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md) + ## [Volume Activation [client]](volume-activation/volume-activation-windows-10.md) ### [Plan for volume activation [client]](volume-activation/plan-for-volume-activation-client.md) ### [Activate using Key Management Service [client]](volume-activation/activate-using-key-management-service-vamt.md) @@ -130,91 +229,5 @@ ### [Monitor activation [client]](volume-activation/monitor-activation-client.md) ### [Use the Volume Activation Management Tool [client]](volume-activation/use-the-volume-activation-management-tool-client.md) ### [Appendix: Information sent to Microsoft during activation [client]](volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md) -## [Windows 10 Enterprise E3 in CSP Overview](windows-10-enterprise-e3-overview.md) -## [Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md) -### [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md) -### [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md) -### [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -#### [Introduction to VAMT](volume-activation/introduction-vamt.md) -#### [Active Directory-Based Activation Overview](volume-activation/active-directory-based-activation-overview.md) -#### [Install and Configure VAMT](volume-activation/install-configure-vamt.md) -##### [VAMT Requirements](volume-activation/vamt-requirements.md) -##### [Install VAMT](volume-activation/install-vamt.md) -##### [Configure Client Computers](volume-activation/configure-client-computers-vamt.md) -#### [Add and Manage Products](volume-activation/add-manage-products-vamt.md) -##### [Add and Remove Computers](volume-activation/add-remove-computers-vamt.md) -##### [Update Product Status](volume-activation/update-product-status-vamt.md) -##### [Remove Products](volume-activation/remove-products-vamt.md) -#### [Manage Product Keys](volume-activation/manage-product-keys-vamt.md) -##### [Add and Remove a Product Key](volume-activation/add-remove-product-key-vamt.md) -##### [Install a Product Key](volume-activation/install-product-key-vamt.md) -##### [Install a KMS Client Key](volume-activation/install-kms-client-key-vamt.md) -#### [Manage Activations](volume-activation/manage-activations-vamt.md) -##### [Perform Online Activation](volume-activation/online-activation-vamt.md) -##### [Perform Proxy Activation](volume-activation/proxy-activation-vamt.md) -##### [Perform KMS Activation](volume-activation/kms-activation-vamt.md) -##### [Perform Local Reactivation](volume-activation/local-reactivation-vamt.md) -##### [Activate an Active Directory Forest Online](volume-activation/activate-forest-vamt.md) -##### [Activate by Proxy an Active Directory Forest](volume-activation/activate-forest-by-proxy-vamt.md) -#### [Manage VAMT Data](volume-activation/manage-vamt-data.md) -##### [Import and Export VAMT Data](volume-activation/import-export-vamt-data.md) -##### [Use VAMT in Windows PowerShell](volume-activation/use-vamt-in-windows-powershell.md) -#### [VAMT Step-by-Step Scenarios](volume-activation/vamt-step-by-step.md) -##### [Scenario 1: Online Activation](volume-activation/scenario-online-activation-vamt.md) -##### [Scenario 2: Proxy Activation](volume-activation/scenario-proxy-activation-vamt.md) -##### [Scenario 3: KMS Client Activation](volume-activation/scenario-kms-activation-vamt.md) -#### [VAMT Known Issues](volume-activation/vamt-known-issues.md) -### [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) -#### [User State Migration Tool (USMT) Overview Topics](usmt/usmt-topics.md) -##### [User State Migration Tool (USMT) Overview](usmt/usmt-overview.md) -##### [Getting Started with the User State Migration Tool (USMT)](usmt/getting-started-with-the-user-state-migration-tool.md) -##### [Windows Upgrade and Migration Considerations](upgrade/windows-upgrade-and-migration-considerations.md) -#### [User State Migration Tool (USMT) How-to topics](usmt/usmt-how-to.md) -##### [Exclude Files and Settings](usmt/usmt-exclude-files-and-settings.md) -##### [Extract Files from a Compressed USMT Migration Store](usmt/usmt-extract-files-from-a-compressed-migration-store.md) -##### [Include Files and Settings](usmt/usmt-include-files-and-settings.md) -##### [Migrate Application Settings](usmt/migrate-application-settings.md) -##### [Migrate EFS Files and Certificates](usmt/usmt-migrate-efs-files-and-certificates.md) -##### [Migrate User Accounts](usmt/usmt-migrate-user-accounts.md) -##### [Reroute Files and Settings](usmt/usmt-reroute-files-and-settings.md) -##### [Verify the Condition of a Compressed Migration Store](usmt/verify-the-condition-of-a-compressed-migration-store.md) -#### [User State Migration Tool (USMT) Troubleshooting](usmt/usmt-troubleshooting.md) -##### [Common Issues](usmt/usmt-common-issues.md) -##### [Frequently Asked Questions](usmt/usmt-faq.md) -##### [Log Files](usmt/usmt-log-files.md) -##### [Return Codes](usmt/usmt-return-codes.md) -##### [USMT Resources](usmt/usmt-resources.md) -#### [User State Migration Toolkit (USMT) Reference](usmt/usmt-reference.md) -##### [USMT Requirements](usmt/usmt-requirements.md) -##### [USMT Best Practices](usmt/usmt-best-practices.md) -##### [How USMT Works](usmt/usmt-how-it-works.md) -##### [Plan Your Migration](usmt/usmt-plan-your-migration.md) -###### [Common Migration Scenarios](usmt/usmt-common-migration-scenarios.md) -###### [What Does USMT Migrate?](usmt/usmt-what-does-usmt-migrate.md) -###### [Choose a Migration Store Type](usmt/usmt-choose-migration-store-type.md) -####### [Migration Store Types Overview](usmt/migration-store-types-overview.md) -####### [Estimate Migration Store Size](usmt/usmt-estimate-migration-store-size.md) -####### [Hard-Link Migration Store](usmt/usmt-hard-link-migration-store.md) -####### [Migration Store Encryption](usmt/usmt-migration-store-encryption.md) -###### [Determine What to Migrate](usmt/usmt-determine-what-to-migrate.md) -####### [Identify Users](usmt/usmt-identify-users.md) -####### [Identify Applications Settings](usmt/usmt-identify-application-settings.md) -####### [Identify Operating System Settings](usmt/usmt-identify-operating-system-settings.md) -####### [Identify File Types, Files, and Folders](usmt/usmt-identify-file-types-files-and-folders.md) -###### [Test Your Migration](usmt/usmt-test-your-migration.md) -##### [User State Migration Tool (USMT) Command-line Syntax](usmt/usmt-command-line-syntax.md) -###### [ScanState Syntax](usmt/usmt-scanstate-syntax.md) -###### [LoadState Syntax](usmt/usmt-loadstate-syntax.md) -###### [UsmtUtils Syntax](usmt/usmt-utilities.md) -##### [USMT XML Reference](usmt/usmt-xml-reference.md) -###### [Understanding Migration XML Files](usmt/understanding-migration-xml-files.md) -###### [Config.xml File](usmt/usmt-configxml-file.md) -###### [Customize USMT XML Files](usmt/usmt-customize-xml-files.md) -###### [Custom XML Examples](usmt/usmt-custom-xml-examples.md) -###### [Conflicts and Precedence](usmt/usmt-conflicts-and-precedence.md) -###### [General Conventions](usmt/usmt-general-conventions.md) -###### [XML File Requirements](usmt/xml-file-requirements.md) -###### [Recognized Environment Variables](usmt/usmt-recognized-environment-variables.md) -###### [XML Elements Library](usmt/usmt-xml-elements-library.md) -##### [Offline Migration Reference](usmt/offline-migration-reference.md) -## [Change history for Deploy Windows 10](change-history-for-deploy-windows-10.md) \ No newline at end of file + +## [Change history for Deploy, Upgrade and Update Windows 10](change-history-for-deploy-windows-10.md) \ No newline at end of file diff --git a/windows/deployment/images/security-update.png b/windows/deployment/images/security-update.png new file mode 100644 index 0000000000..f7ca20f34e Binary files /dev/null and b/windows/deployment/images/security-update.png differ diff --git a/windows/deployment/index.md b/windows/deployment/index.md index 2ef5fbaf96..b24224172e 100644 --- a/windows/deployment/index.md +++ b/windows/deployment/index.md @@ -9,34 +9,69 @@ localizationpriority: high author: greg-lindsay --- -# Deploy Windows 10 -Learn about deploying Windows 10 for IT professionals. + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ + +# Deploy, Upgrade and Update Windows 10 +Learn about deployment in Windows 10 for IT professionals. This includes deploying the operating system, upgrading to it from previous version and updating Windows 10. ## In this section + +### Deploy Windows 10 |Topic |Description | |------|------------| |[What's new in Windows 10 deployment](deploy-whats-new.md) |See this topic for a summary of new features and some recent changes related to deploying Windows 10 in your organization. | +|[Plan for Windows 10 deployment](planning/index.md) | This topic provides information about Windows 10 deployment considerations. It also provides details to assist in Windows 10 deployment planning. | |[Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) |To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the key capabilities and limitations of each, is a key task. | -|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | -|[Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md), [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | -|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | +|[Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md) |Learn about the tools available to deploy Windows 10. | |[Deploy Windows 10 with System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) |If you have Microsoft System Center 2012 R2 Configuration Manager in your environment, you will most likely want to use it to deploy Windows 10. This topic will show you how to set up Configuration Manager for operating system deployment and how to integrate Configuration Manager with the Microsoft Deployment Toolkit (MDT) or. | -|[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) |This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. | -|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | -|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | -|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. | +|[Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | +|[Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md), [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | + +### Upgrade to Windows 10 +|Topic |Description | +|------|------------| |[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |You can upgrade directly to Windows 10 from a previous operating system. | +|[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. | |[Deploy Windows To Go in your organization](deploy-windows-to-go.md) |This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. | |[Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management](upgrade/upgrade-windows-phone-8-1-to-10.md) |This topic describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile. | +|[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | +|[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) |This topic provides a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. | + +### Update Windows 10 +|Topic |Description | +|------|------------| +| [Quick guide to Windows as a service](update/waas-quick-start.md) | Provides a brief summary of the key points for the new servicing model for Windows 10. | +| [Overview of Windows as a service](update/waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | +| [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | +| [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | +| [Assign devices to servicing branches for Windows 10 updates](update/waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider. | +| [Monitor Windows Updates with Update Compliance](update/update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. | +| [Optimize update delivery for Windows 10 updates](update/waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | +| [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](update/waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. | +| [Deploy updates using Windows Update for Business](update/waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | +| [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](update/waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | +| [Deploy Windows 10 updates using System Center Configuration Manager](update/waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | +| [Manage device restarts after updates](update/waas-restart.md) | Explains how to manage update related device restarts. | +| [Manage additional Windows Update settings](update/waas-wu-settings.md) | Provides details about settings available to control and configure Windows Update | +| [Windows Insider Program for Business](update/waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | + +### Additional topics +|Topic |Description | +|------|------------| +|[Convert MBR partition to GPT](mbr-to-gpt.md) |This topic provides detailed instructions for using the MBR2GPT partition conversion tool. | +|[Configure a PXE server to load Windows PE](configure-a-pxe-server-to-load-windows-pe.md) |This guide describes how to configure a PXE server to load Windows PE by booting a client computer from the network. | |[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) |Sideload line-of-business apps in Windows 10. | |[Volume Activation [client]](volume-activation/volume-activation-windows-10.md) |This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. | -|[Windows 10 deployment tools reference](windows-10-deployment-tools-reference.md) |Learn about the tools available to deploy Windows 10. | |[Change history for Deploy Windows 10](change-history-for-deploy-windows-10.md) |This topic lists new and updated topics in the Deploy Windows 10 documentation for [Windows 10 and Windows 10 Mobile](/windows/windows-10). | -## Related topics -- [Windows 10 and Windows 10 Mobile](/windows/windows-10) -     diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index dad9a37627..8a67edbacb 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -7,6 +7,14 @@ ms.sitesec: library author: DaniHalfin localizationpriority: high --- + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ # Update Windows 10 in the enterprise @@ -40,7 +48,8 @@ Windows as a service provides a new way to think about building, deploying, and | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | | [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | | [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | -| [Manage device restarts after updates](waas-restart.md) | Explains how to use Group Policy to manage device restarts. | +| [Manage device restarts after updates](waas-restart.md) | Explains how to manage update related device restarts. | +| [Manage additional Windows Update settings](waas-wu-settings.md) | Provides details about settings available to control and configure Windows Update | | [Windows Insider Program for Business](waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | >[!TIP] diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 0a1d7e7ce0..2df47d49ca 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -2,7 +2,7 @@ title: Configure Windows Update for Business (Windows 10) description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library author: DaniHalfin localizationpriority: high diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 070e8de2d1..919c9ff1d3 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -2,7 +2,7 @@ title: Configure Delivery Optimization for Windows 10 updates (Windows 10) description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library author: DaniHalfin localizationpriority: high diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md index 6d68004a30..b4d572a34d 100644 --- a/windows/deployment/update/waas-manage-updates-configuration-manager.md +++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md @@ -7,6 +7,14 @@ ms.sitesec: library author: DaniHalfin localizationpriority: high --- + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ # Deploy Windows 10 updates using System Center Configuration Manager diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 2c9f7a83e5..b06e61e3bf 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -7,6 +7,14 @@ ms.sitesec: library author: DaniHalfin localizationpriority: high --- + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ # Deploy Windows 10 updates using Windows Server Update Services (WSUS) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index d7207457f6..8bdfad5ea7 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -7,6 +7,14 @@ ms.sitesec: library author: DaniHalfin localizationpriority: high --- + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ # Deploy updates using Windows Update for Business diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index da651bccc2..4d57b5a82a 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -2,7 +2,7 @@ title: Manage device restarts after updates (Windows 10) description: tbd ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library author: DaniHalfin localizationpriority: high diff --git a/windows/deployment/update/waas-servicing-branches-windows-10-updates.md b/windows/deployment/update/waas-servicing-branches-windows-10-updates.md index d92a5becf5..494677a20d 100644 --- a/windows/deployment/update/waas-servicing-branches-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-branches-windows-10-updates.md @@ -2,7 +2,7 @@ title: Assign devices to servicing branches for Windows 10 updates (Windows 10) description: tbd ms.prod: w10 -ms.mktglfcycl: manage +ms.mktglfcycl: deploy ms.sitesec: library author: DaniHalfin localizationpriority: high diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md new file mode 100644 index 0000000000..b2d249199f --- /dev/null +++ b/windows/deployment/update/waas-wu-settings.md @@ -0,0 +1,177 @@ +--- +title: Manage additional Windows Update settings (Windows 10) +description: Additional settings to control the behavior of Windows Update (WU) in Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: DaniHalfin +localizationpriority: high +--- + +# Manage additional Windows Update settings + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update (WU) on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more. + +>[!IMPORTANT] +>In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. + +## Summary of Windows Update settings + +| Group Policy setting | MDM setting | Supported from version | +| --- | --- | --- | +| [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) | [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | All | +| [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) | [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency) | 1703 | +| [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) | | All | +| [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) | | All | +| [Enable client-side targeting](#enable-client-side-targeting) | | All | +| [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | +| [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | +| [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | + +>[!IMPORTANT] +>Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. +> +>Additional settings that configure when Feature and Quality updates are received are detailed on **[Configure Windows Update for Business](waas-configure-wufb.md)**. + +## Scanning for updates + +With Windows 10, admins have a lot of flexibility in configuring how their devices scan and receive updates. + +[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them to option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. + +You can make custom device groups that'll work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). + +Finally, to make sure the updating experience is fully controlled by the admins, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users. + +For additional settings that configure when Feature and Quality updates are received, see [Configure Windows Update for Business](waas-configure-wufb.md). + +### Specify Intranet Microsoft update service location + +Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. +This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. + +To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. + +If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. +If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. + +The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. +The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. + +>[!NOTE] +>If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. +> +>If the "Alternate Download Server" is not set, it will use the intranet update service by default to download updates. +> +>The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. + +To configure this policy with MDM, use [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate). + +### Automatic Updates detection frequency + +Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is determined by using the hours specified here minus zero to twenty percent of the hours specified. For example, if this policy is used to specify a 20-hour detection frequency, then all clients to which this policy is applied will check for updates anywhere between 16 to 20 hours. + +To set this setting with Group Policy, navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Automatic Updates detection frequency**. + +If the setting is set to **Enabled**, Windows will check for available updates at the specified interval. +If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours. + +>[!NOTE] +>The “Specify intranet Microsoft update service location” setting must be enabled for this policy to have effect. +> +>If the “Configure Automatic Updates” policy is disabled, this policy has no effect. + +To configure this policy with MDM, use [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency). + +### Remove access to use all Windows Update features + +By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. + +### Do not connect to any Windows Update Internet locations + +Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store. + +Use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations** to enable this policy. When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working. + +>[!NOTE] +>This policy applies only when the device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. + +### Enable client-side targeting + +Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or SCCM. + +This Group Policy setting can be found under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting**. +If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer. +If the setting is set to **Disabled** or **Not Configured**, no target group information will be sent to the intranet Microsoft update service. + +If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified. + +>[!NOTE] +>This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the “Specify intranet Microsoft update service location” policy is disabled or not configured, this policy has no effect. + +### Allow signed updates from an intranet Microsoft update service location + +This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. + +To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. + +If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the “Trusted Publishers” certificate store of the local computer. +If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. + +>[!NOTE] +>Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting. + +To configure this policy with MDM, use [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate). + + +## Installing updates + +To add more flexibility to the update process, settings are available to control update installation. + +[Configure Automatic Updates](#configure-automatic-updates) offers 4 different options for automatic update installation, while [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) makes sure drivers are not installed with the rest of the received updates. + +### Do not include drivers with Windows Updates + +Allows admins to exclude Windows Update (WU) drivers during updates. + +To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. +Enable this policy to not include drivers with Windows quality updates. +If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. + +### Configure Automatic Updates + +Enables the IT admin to manage automatic update behavior to scan, download, and install updates. + +When enabling this setting through Group Policy, under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the four options: + +**2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates. + +**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to **Settings > Update & security > Windows Update**, users can install them. + +**4 - Auto download and schedule the install** - Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see [Schedule update installation](waas-restart.md#schedule-update-installation). + +**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +If this setting is set to *Disabled*, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to **Settings > Update & security > Windows Update**. + +If this setting is set to *Not Configured*, an administrator can still configure Automatic Updates through the settings app, under **Settings > Update & security > Windows Update > Advanced options**. + + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Manage device restarts after updates](waas-restart.md) \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index 2e289b8a5b..fa59c94780 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -68,7 +68,7 @@ To run the Upgrade Readiness deployment script: 5. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. -The deployment script displays the following exit codes to let ddfyou know if it was successful, or if an error was encountered. +The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered.
@@ -259,5 +259,26 @@ The deployment script displays the following exit codes to let ddfyou know if it + + + + + + + + + + + + + + + + + + + + +
43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. Check the logs for the exception message and HResult.
44 - Diagtrack.dll version is old, so Auth Proxy will not work.Update the PC using Windows Update/Windows Server Update Services.
45 - Diagrack.dll was not found.Update the PC using Windows Update/Windows Server Update Services.
46 - **DisableEnterpriseAuthProxy** property should be set to **1** for **ClientProxy=Telemetry** to work.Set the **DisableEnterpriseAuthProxy** registry property to **1** at key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**.
47 - **TelemetryProxyServer** is not present in key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**.**ClientProxy** selected is **Telemetry**, but you need to add **TelemetryProxyServer** in key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**.
48 - **CommercialID** mentioned in RunConfig.bat should be a GUID.**CommercialID** is mentioned in RunConfig.bat, but it is not a GUID. Copy the commercialID from your workspace. To find the commercialID, in the OMS portal click **Upgrade Readiness > Settings**.
diff --git a/windows/device-security/TOC.md b/windows/device-security/TOC.md index ec0aee811a..9305ed157e 100644 --- a/windows/device-security/TOC.md +++ b/windows/device-security/TOC.md @@ -12,7 +12,6 @@ #### [Monitor app usage with AppLocker](applocker\monitor-application-usage-with-applocker.md) #### [Manage packaged apps with AppLocker](applocker\manage-packaged-apps-with-applocker.md) #### [Working with AppLocker rules](applocker\working-with-applocker-rules.md) -#### [Working with AppLocker rules](applocker\working-with-applocker-rules.md) ##### [Create a rule that uses a file hash condition](applocker\create-a-rule-that-uses-a-file-hash-condition.md) ##### [Create a rule that uses a path condition](applocker\create-a-rule-that-uses-a-path-condition.md) ##### [Create a rule that uses a publisher condition](applocker\create-a-rule-that-uses-a-publisher-condition.md) @@ -561,6 +560,7 @@ ##### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) ##### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) ##### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) +##### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) ##### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) ##### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) ##### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) diff --git a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md index bb1822aebb..5853b5df22 100644 --- a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md @@ -237,7 +237,7 @@ On a computer with a compatible TPM, four types of authentication methods can be - only the TPM for authentication - insertion of a USB flash drive containing the startup key -- the entry of a 4-digit to 20-digit personal identification number (PIN) +- the entry of a 6-digit to 20-digit personal identification number (PIN) - a combination of the PIN and the USB flash drive There are four options for TPM-enabled computers or devices: @@ -323,7 +323,7 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

Policy description

-

With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits.

+

With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits, and it can have a maximum length of 20 digits.

Introduced

@@ -347,14 +347,14 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

When disabled or not configured

-

Users can configure a startup PIN of any length between 4 and 20 digits.

+

Users can configure a startup PIN of any length between 6 and 20 digits.

  **Reference** -This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. +This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits. ### Disable new DMA devices when this computer is locked @@ -527,7 +527,7 @@ This policy setting is used to control what unlock options are available for com   **Reference** -On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 4-digit to 20-digit startup PIN. +On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 6-digit to 20-digit startup PIN. A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive. diff --git a/windows/device-security/change-history-for-device-security.md b/windows/device-security/change-history-for-device-security.md index 850d3d83c0..20d4edb47f 100644 --- a/windows/device-security/change-history-for-device-security.md +++ b/windows/device-security/change-history-for-device-security.md @@ -11,7 +11,12 @@ author: brianlic-msft # Change history for device security This topic lists new and updated topics in the [Device security](index.md) documentation. +## May 2017 +|New or changed topic |Description | +|---------------------|------------| +| [BitLocker Group Policy settings](bitlocker/bitlocker-group-policy-settings.md) | Changed startup PIN minimun length from 4 to 6. | + ## March 2017 |New or changed topic |Description | |---------------------|------------| -|[Requirements and deployment planning guidelines for Device Guard](device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md) |Updated to include additional security qualifications starting with Window 10, version 1703.| \ No newline at end of file +|[Requirements and deployment planning guidelines for Device Guard](device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md) | Updated to include additional security qualifications starting with Windows 10, version 1703.| \ No newline at end of file diff --git a/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md new file mode 100644 index 0000000000..f28eab1191 --- /dev/null +++ b/windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -0,0 +1,154 @@ +--- +title: Network access - Restrict clients allowed to make remote calls to SAM +description: Security policy setting that controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +localizationpriority: high +author: brianlic-msft +--- + +# Network access: Restrict clients allowed to make remote calls to SAM + +**Applies to** +- Windows 10, version 1607 and later +- Windows 10, version 1511 with [KB 4103198](https://support.microsoft.com/en-us/help/4013198) installed +- Windows 10, version 1507 with [KB 4012606](https://support.microsoft.com/en-us/help/4012606) installed +- Windows 8.1 with [KB 4102219](https://support.microsoft.com/en-us/help/4012219/march-2017-preview-of-monthly-quality-rollup-for-windows-8-1-and-windows-server-2012-r2) installed +- Windows 7 with [KB 4012218](https://support.microsoft.com/en-us/help/4012218/march-2017-preview-of-monthly-quality-rollup-for-windows-7-sp1-and-windows-server-2008-r2-sp1) installed +- Windows Server 2016 +- Windows Server 2012 R2 with[KB 4012219](https://support.microsoft.com/en-us/help/4012219/march-2017-preview-of-monthly-quality-rollup-for-windows-8-1-and-windows-server-2012-r2) installed +- Windows Server 2012 with [KB 4012220](https://support.microsoft.com/en-us/help/4012220/march-2017-preview-of-monthly-quality-rollup-for-windows-server-2012) installed +- Windows Server 2008 R2 with [KB 4012218](https://support.microsoft.com/en-us/help/4012218/march-2017-preview-of-monthly-quality-rollup-for-windows-7-sp1-and-windows-server-2008-r2-sp1) installed + + +The **Network access: Restrict clients allowed to make remote calls to SAM** security policy setting controls which users can enumerate users and groups in the local Security Accounts Manager (SAM) database. The setting was first supported by Windows 10 version 1607 and Windows Server 2016 (RTM) and can be configured on earlier Windows client and server operating systems by installing updates from the the KB articles listed in **Applies to** section of this topic. + +This topic describes the default values for this security policy setting in different versions of Windows, related events, and how to enable audit mode before constraining the security principals that are allowed to remotely enumerate users and groups in the SAM so that your environment remains secure without adversely impacting application compatibility. + +## Reference + +The SAMRPC protocol makes it possible for a low privileged user to query a machine on a network for data. For example, a user can use SAMRPC to enumerate users, including privileged accounts such as local or domain administrators, or to enumerate groups and group memberships from the local SAM and Active Directory. This information can provide important context and serve as a starting point for an attacker to compromise a domain or networking environment. + +To mitigate this risk, you can configure the **Network access: Restrict clients allowed to make remote calls to SAM** security policy setting to force the security accounts manager (SAM) to do an access check against remote calls. The access check allows or denies remote RPC connections to SAM and Active Directory for users and groups that you define. + +By default, the **Network access: Restrict clients allowed to make remote calls to SAM** security policy setting is not defined. If you define it, you can edit the default Security Descriptor Definition Language (SDDL) string to explicitly allow or deny users and groups to make remote calls to the SAM. If the policy setting is left blank after the policy is defined, the policy is not enforced. + +The default security descriptor on computers beginning with Windows 10 version 1607 and Windows Server 2016 allows only the local (built-in) Administrators group remote access to SAM on non-domain controllers, and allows Everyone access on domain controllers. You can edit the default security descriptor to allow or deny other users and groups, including the built-in Administrators. + +The default security descriptor on computers that run earlier versions of Windows does not restrict any remote calls to SAM, but an administrator can edit the security descriptor to enforce restrictions. This less restrictive default allows for testing the impact of enabling restrictions on existing applications. + +This means that if you have a mix of computers, such as servers that run both Windows Server 2016 and Windows Server 2012 R2, the servers that run Windows Server 2016 may fail to enumerate accounts by default where the servers that run Windows Server 2012 R2 succeed. + +## Possible values +- Not defined +- Defined, along with the security descriptor for users and groups who are allowed or denied remote access to local SAM and Active directory using SAMRPC. + +## Location + +Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options + +This policy setting controls a string that will contain the SDDL of the security descriptor to be deployed to the following registry setting: + +HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\RestrictRemoteSam + +> [!NOTE] +This policy is implemented similarly to other Network access policies in that there is a single policy element at the registry path listed. There is no notion of a local policy versus an enterprise policy; there is just one policy setting and whichever writes last wins. For example, suppose a local administrator configures this setting as part of a local policy using the Local Security Policy snap-in (Secpol.msc), which edits that same registry path. If an enterprise administrator configures this setting as part of an enterprise GPO, that enterprise GPO will overwrite the same registry path. + +## Default values +Beginning with Windows 10, version 1607 and Windows Server 2016, computers have hard-coded and more restrictive default values than earlier versions of Windows. The different default values help strike a balance where recent Windows versions are more secure by default and older versions don’t undergo any disruptive behavior changes. Computers that run earlier versions of Windows do not perform any access check by default. That includes domain controllers and non-domain controllers. This allows administrators to test whether applying the same restriction (that is, granting READ_CONTROL access only to members of the local Administrators group) will cause compatibility problems for existing applications before implementing this security policy setting in a production environment. + +In other words, the hotfix in each KB article provides the necessary code and functionality, but you need to configure the restriction after you install the hotfix—no restrictions are enabled by default after the hotfix is installed on earlier versions of Windows. + +### Default values beginning with Windows 10 version 1607 and Windows Server 2016 +The following default values apply to computers beginning with Windows Server 2016 and Windows 10, version 1607. The default security descriptor for non-domain controllers grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. + + +| |Default SDDL |Translated SDDL| Comments +|---|---|---|---| +|Domain controller (reading Active Directory|“”|-|Everyone has read permissions to preserve compatibility. +|Non-domain controller|(O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]------------------------- AceType:0x00
(ACCESS_ALLOWED_ACE_TYPE)
AceSize:0x0018
InheritFlags:0x00
Access Mask:0x00020000
AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

SACL: Not present |Only members of the local (built-in) Administrators group get access.| + +### Default values for earlier versions of Windows + +The following sections explain how to enable audit only mode to test the restriction while using applications you plan to run. + +## Policy management + +This section explains how to configure audit-only mode, how to analyze related events that are logged when the Network access: Restrict clients allowed to make remote calls to SAM security policy setting is enabled, and how to configure event throttling to prevent flooding the event log. + +### Audit only mode + +Audit only mode configures the SAM interface to do the access check against the currently configured security descriptor but will not fail the call if the access check fails. Instead, the call will be allowed, but the SAM interface will log an event describing what would have happened if the feature had been enabled. This provides administrators a way to test their applications before enabling the policy in production. Audit only mode is not configured by default. To configure it, add the following registry setting. + +|Registry|Details| +|---|---| +|Path|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa| +|Setting|RestrictRemoteSamAuditOnlyMode| +|Data Type|REG_DWORD| +|Value|1| +|Notes|This setting cannot be added or removed by using predefined Group Policy settings.
Administrators may create a custom policy to set the registry value if needed.
SAM responds dynamically to changes in this registry value without a reboot.
You can use the [Events 16962 - 16969 Reader](https://gallery.technet.microsoft.com/Events-16962-16969-Reader-2eae5f1d) script to parse the event logs, as explained in the next section.| + +### Related events + +There are corresponding events that indicate when remote calls to the SAM are restricted, what accounts attempted to read from the SAM database, and more. The following workflow is recommended to identify applications that may be affected by restricting remote calls to SAM: +1. Dump event logs to a common share. +2. Parse them with the [Events 16962 - 16969 Reader](https://gallery.technet.microsoft.com/Events-16962-16969-Reader-2eae5f1d) script. +3. Look for the following events:
+• For domain controllers, events are logged in the Directory Services log in Event Viewer with event source Directory-Service-SAM (from Event ID 16962 to 16969, as listed in the following table).
+• For non-domain controllers, the same event IDs are logged in the System log with event source Directory-Service-SAM. +4. Identify which security contexts are enumerating users or groups in the SAM database. +5. Prioritize the callers, determine if they should be allowed or not, then include the allowed callers in the SDDL string. + +|Event ID|Event Message Text|Explanation | +|---|---|---| +|16962|"Remote calls to the SAM database are being restricted using the default security descriptor: %1.%n "

%2- "Default SD String:" |Emit event when registry SDDL is absent, causing fallback to default hard-coded SDDL (event should include a copy of the default SDDL).| +|16963|Message Text: "Remote calls to the SAM database are being restricted using the configured registry security descriptor: %1.%n"

%1 - "Registry SD String:" |Emit event when a new SDDL is read from the registry (either on startup or change) and is considered valid. The event includes the source and a copy of the queried SDDL. +|16964|"The registry security descriptor is malformed: %1.%n Remote calls to the SAM database are being restricted using the default security descriptor: %2.%n"

%1- "Malformed SD String:"
%2- "Default SD String:"|Emit event when registry SDDL is mal-formed, causing fallback to default hard-coded SDDL (event should include a copy of the default SDDL). +|16965|Message Text: "A remote call to the SAM database has been denied.%nClient SID: %1%n Network address: %2%n"

%1- "Client SID:" %2- "Client Network Address | Emit event when access is denied to a remote client. Event should include identity and network address of the client. +|16966|Audit Mode is enabled-

Message Text: "Audit only mode is now enabled for remote calls to the SAM database. SAM will log an event for clients who would have been denied access in normal mode. %n"|Emit event whenever training mode (see 16968) is enabled or disabled. +|16967|Audit Mode is disabled-

Message Text: "Audit only mode is now disabled for remote calls to the SAM database.%n For more information"|Emit event whenever training mode (see 16968) is enabled or disabled. +|16968| Message Text: "Audit only mode is currently enabled for remote calls to the SAM database.%n The following client would have been normally denied access:%nClient SID: %1 from network address: %2. %n"
%1- "Client SID:"
%2- "Client Network Address:"|Emit event when access would have been denied to a remote client, but was allowed through due to training mode being enabled. Event should include identity and network address of the client.| +|16969|Message Text: "%2 remote calls to the SAM database have been denied in the past %1 seconds throttling window.%n
"%1- "Throttle window:"
%2- "Suppressed Message Count:"| Throttling may be necessary for some events due to expected high volume on some servers causing the event log to wrap.

Note: There is no throttling of events when audit mode is enabled. Environments with a large number of low-privilege and anonymous querying of the remote database may see large numbers of events logged to the System log. For more info, see the [Event Throttling](#event-throttling) section. + +Compare the security context attempting to remotely enumerate accounts with the default security descriptor. Then edit the security descriptor to add accounts that require remote access. + +### Event Throttling +A busy server can flood event logs with events related to the remote enumeration access check. To prevent this, access-denied events are logged once every 15 minutes by default. The length of this period is controlled by the following registry value. + +|Registry Path|System\CurrentControlSet\Control\Lsa\ +|---|---| +Setting |RestrictRemoteSamEventThrottlingWindow| +Data Type |DWORD| +|Value|seconds| +|Reboot Required?|No| +|Notes|**Default** is 900 seconds – 15mins.
The throttling uses a suppressed events counter which starts at 0 and gets incremented during the throttling window.
For example, X events were suppressed in the last 15 minutes.
The counter is restarted after the event 16969 is logged. + +### Restart requirement + +Restarts are not required to enable, disable or modify the **Network access: Restrict clients allowed to make remote calls to SAM security** policy setting, including audit only mode. Changes become effective without a device restart when they are saved locally or distributed through Group Policy. + +## Security considerations + +This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. + +### Vulnerability +The SAMRPC protocol has a default security posture that makes it possible for low-privileged attackers to query a machine on the network for data that is critical to their further hacking and penetration plans.

+The following example illustrates how an attacker might exploit remote SAM enumeration: +1. A low-privileged attacker gains a foothold on a network. +2. The attacker then queries all machines on the network to determine which ones have a highly privileged domain user configured as a local administrator on that machine. +3. If the attacker can then find any other vulnerability on that machine that allows taking it over, the attacker can then squat on the machine waiting for the high-privileged user to logon and then steal or impersonate those credentials. + +### Countermeasure +You can mitigate this vulnerability by enabling the **Network access: Restrict clients allowed to make remote calls** to SAM security policy setting and configuring the SDDL for only those accounts that are explicitly allowed access. + +### Potential impact +If the policy is defined, admin tools, scripts and software that formerly enumerated users, groups and group membership may fail. To identify accounts that may be affected, test this setting in [audit only mode](#audit-only-mode). + +## Related Topics +[Security Options](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/security-options) + +[SAMRi10 - Hardening SAM Remote Access in Windows 10/Server 2016](https://gallery.technet.microsoft.com/SAMRi10-Hardening-Remote-48d94b5b) + +
\ No newline at end of file diff --git a/windows/device-security/security-policy-settings/security-options.md b/windows/device-security/security-policy-settings/security-options.md index 2d25a87621..b4896738f7 100644 --- a/windows/device-security/security-policy-settings/security-options.md +++ b/windows/device-security/security-policy-settings/security-options.md @@ -82,6 +82,7 @@ For info about setting security policies, see [Configure security policy setting | [Network access: Remotely accessible registry paths](network-access-remotely-accessible-registry-paths.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Remotely accessible registry paths** security policy setting.| | [Network access: Remotely accessible registry paths and subpaths](network-access-remotely-accessible-registry-paths-and-subpaths.md)| Describes the best practices, location, values, and security considerations for the **Network access: Remotely accessible registry paths and subpaths** security policy setting. | | [Network access: Restrict anonymous access to Named Pipes and Shares](network-access-restrict-anonymous-access-to-named-pipes-and-shares.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict anonymous access to Named Pipes and Shares** security policy setting. | +| [Network access: Restrict clients allowed to make remote calls to SAM](network-access-restrict-clients-allowed-to-make-remote-sam-calls.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Restrict clients allowed to make remote calls to SAM** security policy setting. | | [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Shares that can be accessed anonymously** security policy setting. | | [Network access: Sharing and security model for local accounts](network-access-sharing-and-security-model-for-local-accounts.md)| Describes the best practices, location, values, policy management and security considerations for the **Network access: Sharing and security model for local accounts** security policy setting. | | [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md)| Describes the location, values, policy management, and security considerations for the **Network security: Allow Local System to use computer identity for NTLM** security policy setting. | diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md index bd6bc5f1e7..c0eb96f69d 100644 --- a/windows/threat-protection/TOC.md +++ b/windows/threat-protection/TOC.md @@ -25,7 +25,7 @@ #### [Investigate files](windows-defender-atp\investigate-files-windows-defender-advanced-threat-protection.md) #### [Investigate an IP address](windows-defender-atp\investigate-ip-windows-defender-advanced-threat-protection.md) #### [Investigate a domain](windows-defender-atp\investigate-domain-windows-defender-advanced-threat-protection.md) -#### [View and organize the Machines view](windows-defender-atp\machines-view-overview-windows-defender-advanced-threat-protection.md) +#### [View and organize the Machines list](windows-defender-atp\machines-view-overview-windows-defender-advanced-threat-protection.md) #### [Investigate machines](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md) ##### [Search for specific alerts](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-alerts) ##### [Filter events from a specific date](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) @@ -72,8 +72,10 @@ #### [Turn on advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md) #### [Turn on preview experience](windows-defender-atp\preview-settings-windows-defender-advanced-threat-protection.md) #### [Configure email notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md) +#### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md) +#### [Enable Threat intel API](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md) ### [Windows Defender ATP settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md) -### [Windows Defender ATP service status](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +### [Windows Defender ATP service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) ### [Troubleshoot Windows Defender ATP](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) ### [Review events and errors on endpoints with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) ### [Windows Defender Antivirus compatibility](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md) @@ -156,4 +158,4 @@ ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Change history for Threat Protection](change-history-for-threat-protection.md) \ No newline at end of file +## [Change history for Threat Protection](change-history-for-threat-protection.md) diff --git a/windows/threat-protection/images/security-update.png b/windows/threat-protection/images/security-update.png new file mode 100644 index 0000000000..f7ca20f34e Binary files /dev/null and b/windows/threat-protection/images/security-update.png differ diff --git a/windows/threat-protection/images/wanna1.png b/windows/threat-protection/images/wanna1.png new file mode 100644 index 0000000000..e90d1cc12c Binary files /dev/null and b/windows/threat-protection/images/wanna1.png differ diff --git a/windows/threat-protection/images/wanna2.png b/windows/threat-protection/images/wanna2.png new file mode 100644 index 0000000000..7b4a1dcd97 Binary files /dev/null and b/windows/threat-protection/images/wanna2.png differ diff --git a/windows/threat-protection/images/wanna3.png b/windows/threat-protection/images/wanna3.png new file mode 100644 index 0000000000..9b0b176366 Binary files /dev/null and b/windows/threat-protection/images/wanna3.png differ diff --git a/windows/threat-protection/images/wanna4.png b/windows/threat-protection/images/wanna4.png new file mode 100644 index 0000000000..17fefde707 Binary files /dev/null and b/windows/threat-protection/images/wanna4.png differ diff --git a/windows/threat-protection/images/wanna5.png b/windows/threat-protection/images/wanna5.png new file mode 100644 index 0000000000..92ecf67d20 Binary files /dev/null and b/windows/threat-protection/images/wanna5.png differ diff --git a/windows/threat-protection/images/wanna6.png b/windows/threat-protection/images/wanna6.png new file mode 100644 index 0000000000..26824af34d Binary files /dev/null and b/windows/threat-protection/images/wanna6.png differ diff --git a/windows/threat-protection/images/wanna7.png b/windows/threat-protection/images/wanna7.png new file mode 100644 index 0000000000..634bd1449d Binary files /dev/null and b/windows/threat-protection/images/wanna7.png differ diff --git a/windows/threat-protection/images/wanna8.png b/windows/threat-protection/images/wanna8.png new file mode 100644 index 0000000000..59b42eb6f6 Binary files /dev/null and b/windows/threat-protection/images/wanna8.png differ diff --git a/windows/threat-protection/index.md b/windows/threat-protection/index.md index 77a4201aad..0f6aaa04b1 100644 --- a/windows/threat-protection/index.md +++ b/windows/threat-protection/index.md @@ -8,6 +8,15 @@ ms.pagetype: security author: brianlic-msft --- + + + + + + +
Icon showing a security alert A wide-spread ransomware attack, known as "WannaCrypt," targets Windows systems that do not yet have the latest updates. Given the severity of this threat, immediately update your Windows systems. [Learn more](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).
+ + # Threat Protection Learn more about how to help protect against threats in Windows 10 and Windows 10 Mobile. diff --git a/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md new file mode 100644 index 0000000000..6d73bea83b --- /dev/null +++ b/windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md @@ -0,0 +1,250 @@ +--- +title: WannaCrypt ransomware worm targets out-of-date systems +description: In this blog, we provide an early analysis of the end-to-end ransomware attack. Please note this threat is still under investigation. The attack is still active, and there is a possibility that the attacker will attempt to react to our detection response. +keywords: wannacry, wannacrypt, wanna, ransomware +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +localizationpriority: medium +author: iaanw +--- + +# WannaCrypt ransomware worm targets out-of-date systems + + +On May 12, 2017 we detected a new ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed. While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the ransomware, known as [WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt), appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install [MS17-010](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx) if they have not already done so. + +Microsoft antimalware telemetry immediately picked up signs of this campaign. Our expert systems gave us visibility and context into this new attack as it happened, allowing [Windows Defender Antivirus](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10) to deliver real-time defense. Through automated analysis, machine learning, and predictive modeling, we were able to rapidly protect against this malware. + +In this blog, we provide an early analysis of the end-to-end ransomware attack. Please note this threat is still under investigation. The attack is still active, and there is a possibility that the attacker will attempt to react to our detection response. + +## Attack vector + +Ransomware threats do not typically spread rapidly. Threats like WannaCrypt (also known as WannaCry, WanaCrypt0r, WCrypt, or WCRY) usually leverage social engineering or email as primary attack vector, relying on users downloading and executing a malicious payload. However, in this unique case, the ransomware perpetrators used publicly available exploit code for the patched SMB 'EternalBlue' vulnerability, [CVE-2017-0145](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0145), which can be triggered by sending a specially crafted packet to a targeted SMBv1 server. This vulnerability was fixed in security bulletin [MS17-010](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx), which was released on March 14, 2017. + +WannaCrypt's spreading mechanism is borrowed from [well-known](https://packetstormsecurity.com/files/142464/MS17-010-SMBv1-SrvOs2FeaToNt-OOB-Remote-Code-Execution.html) [public SMB exploits](https://github.com/RiskSense-Ops/MS17-010), which armed this regular ransomware with worm-like functionalities, creating an entry vector for machines still unpatched even after the fix had become available. + +The exploit code used by WannaCrypt was designed to work only against unpatched Windows 7 and Windows Server 2008 (or earlier OS) systems, so Windows 10 PCs are not affected by this attack. + +We haven't found evidence of the exact initial entry vector used by this threat, but there are two scenarios that we believe are highly possible explanations for the spread of this ransomware: + +- Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit +- Infection through SMB exploit when an unpatched computer is addressable from other infected machines + +## Dropper + +The threat arrives as a dropper Trojan that has the following two components: + +1. A component that attempts to exploit the SMB CVE-2017-0145 vulnerability in other computers +2. The ransomware known as WannaCrypt + +The dropper tries to connect the following domains using the API `InternetOpenUrlA()`: + +- www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com +- www[.]ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com + +If connection to the domains is successful, the dropper does not infect the system further with ransomware or try to exploit other systems to spread; it simply stops execution. However, if the connection fails, the threat proceeds to drop the ransomware and creates a service on the system. + +In other words, unlike in most malware infections, **IT Administrators should NOT block these domains**. Note that the malware is not proxy-aware, so a local DNS record may be required. This does not need to point to the Internet, but can resolve to any accessible server which will accept connections on TCP 80. + +![Connection information from WannaCrypt code](images/wanna1.png) + +The threat creates a service named *mssecsvc2.0*, whose function is to exploit the SMB vulnerability in other computers accessible from the infected system: +``` +Service Name: mssecsvc2.0 +Service Description: (Microsoft Security Center (2.0) Service) +Service Parameters: '-m security' +``` + + ![Mssecsvc2.0 process details](images/wanna2.png) + +## WannaCrypt ransomware + +The ransomware component is a dropper that contains a password-protected .zip archive in its resource section. The document encryption routine and the files in the .zip archive contain support tools, a decryption tool, and the ransom message. In the samples we analyzed, the password for the .zip archive is 'WNcry@2ol7'. + +When run, WannaCrypt creates the following registry keys: + +- *HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\\ = '\\tasksche.exe'* +- *HKLM\SOFTWARE\WanaCrypt0r\\wd = '\'* + +It changes the wallpaper to a ransom message by modifying the following registry key: + +- *HKCU\Control Panel\Desktop\Wallpaper: '\\\@WanaDecryptor@.bmp'* + +It creates the following files in the malware's working directory: + +- *00000000.eky* +- *00000000.pky* +- *00000000.res* +- *274901494632976.bat* +- *@Please_Read_Me@.txt* +- *@WanaDecryptor@.bmp* +- *@WanaDecryptor@.exe* +- *b.wnry* +- *c.wnry* +- *f.wnry* +- *m.vbs* +- *msg\m_bulgarian.wnry* +- *msg\m_chinese (simplified).wnry* +- *msg\m_chinese (traditional).wnry* +- *msg\m_croatian.wnry* +- *msg\m_czech.wnry* +- *msg\m_danish.wnry* +- *msg\m_dutch.wnry* +- *msg\m_english.wnry* +- *msg\m_filipino.wnry* +- *msg\m_finnish.wnry* +- *msg\m_french.wnry* +- *msg\m_german.wnry* +- *msg\m_greek.wnry* +- *msg\m_indonesian.wnry* +- *msg\m_italian.wnry* +- *msg\m_japanese.wnry* +- *msg\m_korean.wnry* +- *msg\m_latvian.wnry* +- *msg\m_norwegian.wnry* +- *msg\m_polish.wnry* +- *msg\m_portuguese.wnry* +- *msg\m_romanian.wnry* +- *msg\m_russian.wnry* +- *msg\m_slovak.wnry* +- *msg\m_spanish.wnry* +- *msg\m_swedish.wnry* +- *msg\m_turkish.wnry* +- *msg\m_vietnamese.wnry* +- *r.wnry* +- *s.wnry* +- *t.wnry* +- *TaskData\Tor\libeay32.dll* +- *TaskData\Tor\libevent-2-0-5.dll* +- *TaskData\Tor\libevent_core-2-0-5.dll* +- *TaskData\Tor\libevent_extra-2-0-5.dll* +- *TaskData\Tor\libgcc_s_sjlj-1.dll* +- *TaskData\Tor\libssp-0.dll* +- *TaskData\Tor\ssleay32.dll* +- *TaskData\Tor\taskhsvc.exe* +- *TaskData\Tor\tor.exe* +- *TaskData\Tor\zlib1.dll* +- *taskdl.exe* +- *taskse.exe* +- *u.wnry* + +WannaCrypt may also create the following files: + +- *%SystemRoot%\tasksche.exe* +- *%SystemDrive%\intel\\\\tasksche.exe* +- *%ProgramData%\\\\tasksche.exe* + +It may create a randomly named service that has the following associated ImagePath: `cmd.exe /c '\tasksche.exe'`. + +It then searches the whole computer for any file with any of the following file name extensions: *.123, .jpeg , .rb , .602 , .jpg , .rtf , .doc , .js , .sch , .3dm , .jsp , .sh , .3ds , .key , .sldm , .3g2 , .lay , .sldm , .3gp , .lay6 , .sldx , .7z , .ldf , .slk , .accdb , .m3u , .sln , .aes , .m4u , .snt , .ai , .max , .sql , .ARC , .mdb , .sqlite3 , .asc , .mdf , .sqlitedb , .asf , .mid , .stc , .asm , .mkv , .std , .asp , .mml , .sti , .avi , .mov , .stw , .backup , .mp3 , .suo , .bak , .mp4 , .svg , .bat , .mpeg , .swf , .bmp , .mpg , .sxc , .brd , .msg , .sxd , .bz2 , .myd , .sxi , .c , .myi , .sxm , .cgm , .nef , .sxw , .class , .odb , .tar , .cmd , .odg , .tbk , .cpp , .odp , .tgz , .crt , .ods , .tif , .cs , .odt , .tiff , .csr , .onetoc2 , .txt , .csv , .ost , .uop , .db , .otg , .uot , .dbf , .otp , .vb , .dch , .ots , .vbs , .der' , .ott , .vcd , .dif , .p12 , .vdi , .dip , .PAQ , .vmdk , .djvu , .pas , .vmx , .docb , .pdf , .vob , .docm , .pem , .vsd , .docx , .pfx , .vsdx , .dot , .php , .wav , .dotm , .pl , .wb2 , .dotx , .png , .wk1 , .dwg , .pot , .wks , .edb , .potm , .wma , .eml , .potx , .wmv , .fla , .ppam , .xlc , .flv , .pps , .xlm , .frm , .ppsm , .xls , .gif , .ppsx , .xlsb , .gpg , .ppt , .xlsm , .gz , .pptm , .xlsx , .h , .pptx , .xlt , .hwp , .ps1 , .xltm , .ibd , .psd , .xltx , .iso , .pst , .xlw , .jar , .rar , .zip , .java , .raw.* + +WannaCrypt encrypts all files it finds and renames them by appending *.WNCRY* to the file name. For example, if a file is named *picture.jpg*, the ransomware encrypts and renames the file to *picture.jpg.WNCRY*. + +This ransomware also creates the file *@Please_Read_Me@.txt* in every folder where files are encrypted. The file contains the same ransom message shown in the replaced wallpaper image (see screenshot below). + +After completing the encryption process, the malware deletes the volume shadow copies by running the following command: +`cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet` + +It then replaces the desktop background image with the following message: + +![Example background image of WannaCrypt](images/wanna3.png) + +It also runs an executable showing a ransom note which indicates a $300 ransom in Bitcoins as well as a timer: + + ![Screenshot of WannaCrypt ransom notice](images/wanna4.png) + +The text is localized into the following languages: Bulgarian, Chinese (simplified), Chinese (traditional), Croatian, Czech, Danish, Dutch, English, Filipino, Finnish, French, German, Greek, Indonesian, Italian, Japanese, Korean, Latvian, Norwegian, Polish, Portuguese, Romanian, Russian, Slovak, Spanish, Swedish, Turkish, and Vietnamese. + +The ransomware also demonstrates the decryption capability by allowing the user to decrypt a few random files, free of charge. It then quickly reminds the user to pay the ransom to decrypt all the remaining files. + + ![Screenshot of decryption window](images/wanna5.png) + +## Spreading capability + +The worm functionality attempts to infect unpatched Windows machines in the local network. At the same time, it also executes massive scanning on Internet IP addresses to find and infect other vulnerable computers. This activity results in large SMB traffic from the infected host, which can be observed by SecOps personnel, as shown below. + +![Spreading scanning activity](images/wanna6.png) + +The Internet scanning routine randomly generates octets to form the IPv4 address. The malware then targets that IP to attempt to exploit CVE-2017-0145. The threat avoids infecting the IPv4 address if the randomly generated value for first octet is 127 or if the value is equal to or greater than 224, in order to skip local loopback interfaces. Once a vulnerable machine is found and infected, it becomes the next hop to infect other machines. The vicious infection cycle continues as the scanning routing discovers unpatched computers. + +When it successfully infects a vulnerable computer, the malware runs kernel-level shellcode that seems to have been copied from the public backdoor known as DOUBLEPULSAR, but with certain adjustments to drop and execute the ransomware dropper payload, both for x86 and x64 systems. + + ![Kernel-level shellcode used by WannaCrypt](images/wanna7.png) + + ![Kernel-level shellcode used by WannaCrypt](images/wanna8.png) + +## Protection against the WannaCrypt attack + +To get the latest protection from Microsoft, upgrade to [Windows 10](https://www.microsoft.com/en-us/windows/windows-10-upgrade). Keeping your computers [up-to-date](https://www.microsoft.com/en-us/security/portal/mmpc/help/updatefaqs.aspx) gives you the benefits of the latest features and proactive mitigations built into the latest versions of Windows. + +We recommend customers that have not yet installed the security update [MS17-010](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx) do so as soon as possible. Until you can apply the patch, we also recommend two possible workarounds to reduce the attack surface: + +- Disable SMBv1 with the steps documented at [Microsoft Knowledge Base Article 2696547](https://support.microsoft.com/kb/2696547) and as [recommended previously](https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/) +- Consider adding a rule on your router or firewall to block incoming SMB traffic on port 445 + +[Windows Defender Antivirus](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10) detects this threat as [Ransom:Win32/WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt) as of the *1.243.297.0* update. Windows Defender Antivirus uses cloud-based protection, helping to protect you from the latest threats. + +For enterprises, use [Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide) to lock down devices and provide kernel-level virtualization-based security, allowing only trusted applications to run, effectively preventing malware from running. + +Use [Office 365 Advanced Threat Protection](https://blogs.office.com/2015/04/08/introducing-exchange-online-advanced-threat-protection/), which has machine learning capability that blocks dangerous email threats, such as the emails carrying ransomware. + +Monitor networks with [Windows Defender Advanced Threat Protection](http://www.microsoft.com/en-us/WindowsForBusiness/windows-atp), which alerts security operations teams about suspicious activities. Download this playbook to see how you can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware in networks: [Windows Defender Advanced Threat Protection - Ransomware response playbook](https://www.microsoft.com/en-us/download/details.aspx?id=55090). + +## Resources + +Download English language security updates: [Windows Server 2003 SP2 x64](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe), [Windows Server 2003 SP2 x86,](http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x86-custom-enu_f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe) [Windows XP SP2 x64](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe), [Windows XP SP3 x86](http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe), [Windows XP Embedded SP3 x86](http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-embedded-custom-enu_8f2c266f83a7e1b100ddb9acd4a6a3ab5ecd4059.exe), [Windows 8 x86,](http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu) [Windows 8 x64](http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu) + +Download localized language security updates: [Windows Server 2003 SP2 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=d3cb7407-3339-452e-8371-79b9c301132e), [Windows Server 2003 SP2 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=350ec04d-a0ba-4a50-9be3-f900dafeddf9), [Windows XP SP2 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=5fbaa61b-15ce-49c7-9361-cb5494f9d6aa), [Windows XP SP3 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=7388c05d-9de6-4c6a-8b21-219df407754f), [Windows XP Embedded SP3 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=a1db143d-6ad2-4e7e-9e90-2a73316e1add), [Windows 8 x86](http://www.microsoft.com/downloads/details.aspx?FamilyId=6e2de6b7-9e43-4b42-aca2-267f24210340), [Windows 8 x64](http://www.microsoft.com/downloads/details.aspx?FamilyId=b08bb3f1-f156-4e61-8a68-077963bae8c0) + +MS17-010 Security Update: [https://technet.microsoft.com/en-us/library/security/ms17-010.aspx](https://technet.microsoft.com/en-us/library/security/ms17-010.aspx) + +Customer guidance for WannaCrypt attacks: [https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/) + +General information on ransomware: [https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx](https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx) + +## Indicators of compromise + +SHA1 of samples analyzed: + +- 51e4307093f8ca8854359c0ac882ddca427a813c +- e889544aff85ffaf8b0d0da705105dee7c97fe26 + +Files created: + +- %SystemRoot%\mssecsvc.exe +- %SystemRoot%\tasksche.exe +- %SystemRoot%\qeriuwjhrf +- b.wnry +- c.wnry +- f.wnry +- r.wnry +- s.wnry +- t.wnry +- u.wnry +- taskdl.exe +- taskse.exe +- 00000000.eky +- 00000000.res +- 00000000.pky +- @WanaDecryptor@.exe +- @Please_Read_Me@.txt +- m.vbs +- @WanaDecryptor@.exe.lnk +- @WanaDecryptor@.bmp +- 274901494632976.bat +- taskdl.exe +- Taskse.exe +- Files with '.wnry' extension +- Files with '.WNCRY' extension + +Registry keys created: + +- HKLM\SOFTWARE\WanaCrypt0r\wd + + + +*Karthik Selvaraj, Elia Florio, Andrea Lelli, and Tanmay Ganacharya*
*Microsoft Malware Protection Center* + diff --git a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index 90098f1ce1..d3a3a91d2b 100644 --- a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -28,7 +28,7 @@ You can use a dedicated command-line tool to perform various functions in Window This utility can be useful when you want to automate the use of Windows Defender Antivirus. -The utility is available in _%Program Files%\Windows Defender\MpCmdRun.exe_ and must be run from a command prompt. +The utility is available in _%ProgramFiles%\Windows Defender\MpCmdRun.exe_ and must be run from a command prompt. > [!NOTE] > You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. @@ -51,6 +51,7 @@ Command | Description \-ListAllDynamicSignature [-Path] | Lists the loaded dynamic signatures \-RemoveDynamicSignature [-SignatureSetID] | Removes a dynamic signature \-ValidateMapsConnection | Used to validate connection to the [cloud-delivered protection service](configure-network-connections-windows-defender-antivirus.md) +\-SignatureUpdate [-UNC [-Path ]] | Checks for new definition updates diff --git a/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index d73a96d98b..194b3e9cfb 100644 --- a/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -146,6 +146,8 @@ Use the following argument with the Windows Defender AV command line utility (*m ```DOS MpCmdRun - ValidateMapsConnection ``` +> [!NOTE] +> You may need to open an administrator-level version of the command prompt. Right-click the item in the Start menu, click **Run as administrator** and click **Yes** at the permissions prompt. See [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender Antivirus](command-line-arguments-windows-defender-antivirus.md) for more information on how to use the *mpcmdrun.exe* utility. diff --git a/windows/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc-defs.png b/windows/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc-defs.png new file mode 100644 index 0000000000..42864aafbb Binary files /dev/null and b/windows/threat-protection/windows-defender-antivirus/images/defender/wdav-wdsc-defs.png differ diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index e65cadaeee..751a8801d2 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Manage how and where Windows Defender AV receives updates -description: Manage how Windows Defender Antivirus receives protection updates. +description: Manage the fallback order for how Windows Defender Antivirus receives protection updates. keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -12,14 +12,14 @@ localizationpriority: medium author: iaanw --- -# Manage Windows Defender Antivirus protection and definition updates +# Manage the sources for Windows Defender Antivirus protection updates **Applies to** - Windows 10 **Audience** -- Network administrators +- Enterprise security administrators **Manageability available with** @@ -31,40 +31,60 @@ author: iaanw -Windows Defender AV uses both [cloud-delivered protection](utilize-microsoft-cloud-protection-windows-defender-antivirus.md) (also called the Microsoft Advanced Protection Service or MAPS) and periodically downloaded protection updates to provide protection. These protection updates are also known as "definitions" or "signature updates". - -The cloud-delivered protection is “always-on” and requires an active connection to the Internet to function, while the protection updates generally occur once a day (although this can be configured). - There are two components to managing protection updates - where the updates are downloaded from, and when updates are downloaded and applied. -This topic describes the locations +This topic describes where you can specify the updates should be downloaded from, also known as the fallback order. + +See the [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) topic for an overview on how updates work, and how to configure other aspects of updates (such as scheduling updates). -## Manage the fallback order for downloading protection updates -There are five locations where you can specify where an endpoint should obtain updates. Typically, you would configure each endpoint to individually download the updates from a primary source and specify fallback sources in case the primary source is unavailable. +There are five locations where you can specify where an endpoint should obtain updates. Typically, you would configure endpoints to individually download the updates from a primary source, followed by the other sources in order of priority based on your network configuration. + +Updates will be obtained from the sources in the order you specify. If a source is not available, the next source in the list will be used. + +You can use the following sources: + + +- Microsoft Update - [Windows Server Update Service (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx) -- Microsoft Update. -- The [Microsoft Malware Protection Center definitions page (MMPC)](http://www.microsoft.com/security/portal/definitions/adl.aspx) +- System Center Configuration Manager - A network file share -- Configuration manager +- The [Microsoft Malware Protection Center definitions page (MMPC)](http://www.microsoft.com/security/portal/definitions/adl.aspx) -Each location has typical scenarios (in addition to acting as fallback locations) for when you would use that source, as described in the following table: + +When updates are published, some logic will be applied to minimize the size of the update. In most cases, only the "delta" (or the differences between the latest update and the update that is currently installed on the endpoint) will be downloaded and applied. However, the size of the delta depends on: + +- How old the current update on the endpoint is +- Which source you use + + +The older the updates on an endpoint, the larger the download. However, you must also consider frequency versus size - a more frequent update schedule may result in more ad hoc network usage, while a less-frequent schedule may result in larger file sizes. + +Microsoft Update allows for rapid releases, which means it will download small deltas on a frequent basis. This ensures the best protection, but may increase network bandwidth. + +The WSUS, Configuration Manager and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger). + +Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: Location | Sample scenario ---|--- -WSUS | You are using WSUS to manage updates for your network -Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network. -MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). -File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments. +WSUS | You are using WSUS to manage updates for your network. +Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use WSUS to manage your updates. +File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments. Configuration Manager | You are using System Center Configuration Manager to update your endpoints. - +MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. + + You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI. > [!IMPORTANT] > If you set WSUS as a download location, you must approve the updates - regardless of what management tool you use to specify the location. You can set up an automatic approval rule with WSUS, which may be useful as updates arrive at least once a day. See [To synchronize endpoint protection updates in standalone WSUS](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/endpoint-definitions-wsus#to-synchronize-endpoint-protection-definition-updates-in-standalone-wsus) for more details. +The procedures in this article first describe how to set the order, and then how to set up the **File share** option if you have enabled it. + + **Use Group Policy to manage the update location:** 1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -77,7 +97,7 @@ You can manage the order in which update sources are used with Group Policy, Sys 1. Double-click the **Define the order of sources for downloading definition updates** setting and set the option to **Enabled**. - 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, shown in the following screenshot. + 2. Enter the order of sources, separated by a single pipe, for example: `InternalDefinitionUpdateServer|MicrosoftUpdateServer|MMPC`, as shown in the following screenshot. ![Screenshot of group policy setting listing the order of sources](images/defender/wdav-order-update-sources.png) @@ -131,11 +151,11 @@ See the following for more information: ## Related topics -- [Deploy, manage updates, and report on Windows Defender Antivirus](deploy-manage-report-windows-defender-antivirus.md) -- [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) +- [Deploy, manage updates, and report on Windows Defender AV](deploy-manage-report-windows-defender-antivirus.md) +- [Manage Windows Defender AV updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md) - [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) - [Manage updates for endpoints that are out of date](manage-outdated-endpoints-windows-defender-antivirus.md) - [Manage event-based forced updates](manage-event-based-updates-windows-defender-antivirus.md) -- [Manage updates for mobile devices and virtual machines (VMs)](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) -- [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) +- [Manage updates for mobile devices and VMs](manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +- [Windows Defender AV in Windows 10](windows-defender-antivirus-in-windows-10.md) diff --git a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md index ebc8b9c83d..0a4d40cb54 100644 --- a/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md @@ -89,13 +89,15 @@ This section describes how to perform some of the most common tasks when reviewi 4. Click **Advanced scan** to specify different types of scans, such as a full scan. - -**Download protection updates in the Windows Defender Security Center app** + +**Review the definition update version and download the latest updates in the Windows Defender Security Center app** 1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). -3. Click **Protection updates**. +3. Click **Protection updates**. The currently installed version is displayed along with some information about when it was downloaded. You can check this against the latest version available for manual download, or review the change log for that version. + +![Definition version number information](images/defender/wdav-wdsc-defs.png) 4. Click **Check for updates** to download new protection updates (if there are any). @@ -129,15 +131,16 @@ This section describes how to perform some of the most common tasks when reviewi 5. Click the plus icon to choose the type and set the options for each exclusion. -**Review threat detection history in the Windows Defender Security Center app** -1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). - -3. Click **Scan history**. - -4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**). - +**Review threat detection history in the Windows Defender Security Center app** +1. Open the Windows Defender Security Center app by clicking the shield icon in the task bar or searching the start menu for **Defender**. + +2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar). + +3. Click **Scan history**. + +4. Click **See full history** under each of the categories (**Current threats**, **Quarantined threats**, **Allowed threats**). + + diff --git a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md index 921bf48bbb..b720246c1e 100644 --- a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- title: View and organize the Windows Defender ATP Alerts queue -description: Learn about how the Windows Defender ATP alerts queue work, and how to sort and filter lists of alerts. +description: Learn about how the Windows Defender ATP alerts queues work, and how to sort and filter lists of alerts. keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -21,7 +21,7 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In any of the queues, you'll see details such as the severity of alerts and the number of machines where the alerts were seen. +The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on. Alerts are organized in queues by their workflow status or assignment: @@ -33,17 +33,17 @@ Alerts are organized in queues by their workflow status or assignment: To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane. > [!NOTE] -> By default, the queues are sorted from newest to oldest. +> By default, alerts in the queues are sorted from newest to oldest. ## Sort and filter the alerts -You can sort and filter the alerts by using the available filters or clicking columns that allows you to sort the view in ascending or descending order. +You can sort and filter the alerts using the available filters or clicking on a column's header that will sort the view in ascending or descending order. ![Alerts queue with numbers](images/alerts-queue-numbered.png) Highlighted area|Area name|Description :---|:---|:--- 1 | Alert filters | Filter the list of alerts by severity, detection source, time period, or change the view from flat to grouped. -2 | Alert selected | Select an alert to bring up the **Alert management** to manage and see details about the alert. +2 | Alert selected | Select an alert to bring up the **Alert management** pane to manage and see details about the alert. 3 | Alert management pane | View and manage alerts without leaving the alerts queue view. ### Sort, filter, and group the alerts list @@ -76,9 +76,9 @@ Reviewing the various alerts and their severity can help you decide on the appro **View**
- **Flat view** - Lists alerts individually with alerts having the latest activity displayed at the top. -- **Grouped view** - Groups alerts by alert ID, file hash, malware family, or other attribute to enable more efficient alert triage and management. Alert grouping reduces the number of rows in the queue by aggregating alerts together. +- **Grouped view** - Groups alerts by alert ID, file hash, malware family, or other attribute to enable more efficient alert triage and management. Alert grouping reduces the number of rows in the queue by aggregating similar alerts together. -The group view allows for efficient alert triage and management. +The grouped view allows efficient alert triage and management. ### Use the Alert management pane Selecting an alert brings up the **Alert management** pane where you can manage and see details about the alert. diff --git a/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md index 22861fbaa2..4fc24b0318 100644 --- a/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md @@ -30,10 +30,19 @@ There are two status indicators on the tile that provide information on the numb - **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month. - **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected. -Clicking any of the groups directs you to Machines view, filtered according to your choice. +Clicking any of the groups directs you to Machines list, filtered according to your choice. ![Windows Defender ATP sensor filter](images/atp-sensor-filter.png) + + +You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md). + You can filter the health state list by the following status: - **Active** - Machines that are actively reporting to the Windows Defender ATP service. - **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service. @@ -45,7 +54,7 @@ You can view the machine details when you click on a misconfigured or inactive m ![Windows Defender ATP sensor filter](images/atp-machine-health-details.png) -In the **Machines view**, you can download a full list of all the machines in your organization in a CSV format. To download, click the **Manage Alert** menu icon on the top corner of the page. +In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format. To download, click the **Manage Alert** menu icon on the top corner of the page. >[!NOTE] >Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is. diff --git a/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md index 8084bd32aa..494eb84889 100644 --- a/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md @@ -35,7 +35,7 @@ The email notification includes basic information about the alert and a link to ## Set up email notifications for alerts The email notifications feature is turned off by default. Turn it on to start receiving email notifications. -1. On the navigation pane, select **Preferences Setup** > **Email Notifications**. +1. On the navigation pane, select **Preferences setup** > **Email Notifications**. 2. Toggle the setting between **On** and **Off**. 3. Select the alert severity level that you’d like your recipients to receive: - **High** – Select this level to send notifications for high-severity alerts. diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index c6e02becaf..703871c3fd 100644 --- a/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -28,7 +28,7 @@ localizationpriority: high ## Onboard endpoints 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Select **Group Policy**, click **Download package** and save the .zip file. @@ -74,6 +74,31 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa >[!NOTE] > If you don't set a value, the default value is to enable sample collection. +### Configure reporting frequency settings +Windows Defender ATP reporting frequency was tested over a large number of machines and is optimized to provide a recommended balance between speed and performance. + +In cases where high-value assets or machines are at high risk, you can configure the reporting frequency to expedite mode, allowing the machine to report at a higher frequency. + +> [!NOTE] +> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical. + +For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal. + +The configuration is set through the following registry key entry: + +``` +Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” +Name: "latency" +Value: Normal or Expedite +``` +Where:
+Key type is a string.
+Possible values are: +- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance +- Expedite - sets reporting frequency from the endpoint to Expedite mode + +The default value in case the registry key doesn’t exist is Normal. + ### Offboard endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. @@ -82,7 +107,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Click the **Endpoint offboarding** section. @@ -104,16 +129,20 @@ For security reasons, the package used to offboard endpoints will expire 30 days 9. Click **OK** and close any open GPMC windows. +> [!IMPORTANT] +> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. + + ## Monitor endpoint configuration With Group Policy there isn’t an option to monitor deployment of policies on the endpoints. Monitoring can be done directly on the portal, or by using the different deployment tools. ## Monitor endpoints using the portal 1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/). -2. Click **Machines view**. +2. Click **Machines list**. 3. Verify that endpoints are appearing. > [!NOTE] -> It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. +> It can take several days for endpoints to start showing on the **Machines list**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. ## Related topics diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index d714ae09df..a17a666708 100644 --- a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -33,7 +33,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Select **Endpoint Management** on the **Navigation pane**. + a. Select **Endpoint management** on the **Navigation pane**. b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file. @@ -80,7 +80,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre ![Microsoft Intune manage deployment](images/atp-intune-manage-deployment.png) -When the policy is deployed and is propagated, endpoints will be shown in the **Machines view**. +When the policy is deployed and is propagated, endpoints will be shown in the **Machines list**. You can use the following onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: - Onboarding @@ -99,12 +99,13 @@ Configuration for onboarded machines: telemetry reporting frequency | ./Device/V > [!NOTE] > - The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated. > - Configuration of telemetry reporting frequency is only available for machines on Windows 10, version 1703. +> - Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical. ### Using the Azure Intune Portal to deploy Windows Defender Advanced Threat Protection policies on Windows 10 1607 and higher 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Select **Endpoint Management** on the **Navigation pane**. + a. Select **Endpoint management** on the **Navigation pane**. b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file. @@ -156,7 +157,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Click the **Endpoint offboarding** section. @@ -180,6 +181,8 @@ Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/W > [!NOTE] > The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated. +> [!IMPORTANT] +> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 89f4c7887d..8406829b2f 100644 --- a/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -39,7 +39,7 @@ You can use System Center Configuration Manager’s existing functionality to cr 1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Select **System Center Configuration Manager 2012/2012 R2/1511/1602**, click **Download package**, and save the .zip file. @@ -61,7 +61,7 @@ This rule should be a *remediating* compliance rule configuration item that sets The configuration is set through the following registry key entry: -```text +``` Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” Name: "AllowSampleCollection" Value: 0 or 1 @@ -76,6 +76,31 @@ The default value in case the registry key doesn’t exist is 1. For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx). +### Configure reporting frequency settings +Windows Defender ATP reporting frequency was tested over a large number of machines and is optimized to provide a recommended balance between speed and performance. + +In cases where high-value assets or machines are at high risk, you can configure the reporting frequency to expedite mode, allowing the machine to report at a higher frequency. + +> [!NOTE] +> Using the Expedite mode might have an impact on the machine's battery usage and actual bandwidth used for sensor data. You should consider this when these measures are critical. + +For each endpoint, you can configure a registry key value that determines how frequent a machine reports sensor data to the portal. + +The configuration is set through the following registry key entry: + +``` +Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” +Name: "latency" +Value: Normal or Expedite +``` +Where:
+Key type is a string.
+Possible values are: +- Normal - sets reporting frequency from the endpoint to Normal mode for the optimal speed and performance balance +- Expedite - sets reporting frequency from the endpoint to Expedite mode + +The default value in case the registry key doesn’t exist is Normal. + ### Offboard endpoints @@ -86,7 +111,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Click the **Endpoint offboarding** section. @@ -94,12 +119,14 @@ For security reasons, the package used to offboard endpoints will expire 30 days 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. -3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682112.aspx#BKMK_Import) topic. - -4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic. +3. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/library/gg682178.aspx) topic. a. Choose a predefined device collection to deploy the package to. +> [!IMPORTANT] +> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. + + ### Monitor endpoint configuration Monitoring with SCCM consists of two parts: diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md index 31b9b673c4..1bde6ab2f6 100644 --- a/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -23,10 +23,13 @@ localizationpriority: high You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. +> [!NOTE] +> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md). + ## Onboard endpoints 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Select **Local Script**, click **Download package** and save the .zip file. @@ -54,7 +57,7 @@ You can manually configure the sample sharing setting on the endpoint by using * The configuration is set through the following registry key entry: -```text +``` Path: “HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection” Name: "AllowSampleCollection" Value: 0 or 1 @@ -76,7 +79,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click **Endpoint Management** on the **Navigation pane**. + a. Click **Endpoint management** on the **Navigation pane**. b. Click the **Endpoint offboarding** section. @@ -96,6 +99,10 @@ For security reasons, the package used to offboard endpoints will expire 30 days 5. Press the **Enter** key or click **OK**. +> [!IMPORTANT] +> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months. + + ## Monitor endpoint configuration You can follow the different verification steps in the [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) to verify that the script completed successfully and the agent is running. @@ -104,7 +111,7 @@ Monitoring can also be done directly on the portal, or by using the different de ### Monitor endpoints using the portal 1. Go to the Windows Defender ATP portal. -2. Click **Machines view**. +2. Click **Machines list**. 3. Verify that endpoints are appearing. diff --git a/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 2f6d228d47..6c9b1b4da5 100644 --- a/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -77,7 +77,7 @@ netsh winhttp set proxy : For example: netsh winhttp set proxy 10.0.0.6:8080 ## Enable access to Windows Defender ATP service URLs in the proxy server -If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: +If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443: Primary Domain Controller | .Microsoft.com DNS record :---|:--- @@ -86,10 +86,6 @@ Europe |```*.blob.core.windows.net```
```crl.microsoft.com```
```eu.vorte If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the above listed URLs. - If you selected US as your region, you should permit anonymous traffic for URLs listed in both Central US and East US (2). - - If you selected EU as your region, you should permit anonymous traffic for URLs listed in both West Europe and North Europe. - ## Verify client connectivity to Windows Defender ATP service URLs diff --git a/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md index e8de1cb1b4..07eb913511 100644 --- a/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md @@ -24,10 +24,12 @@ localizationpriority: high The **Dashboard** displays a snapshot of: - The latest active alerts on your network -- Machines reporting -- Top machines with active alerts -- The overall status of Windows Defender ATP for the past 30 days -- Machines with active malware detections +- Daily machines reporting +- Machines at risk +- Users at risk +- Machines with active malware alerts +- Sensor health +- Service health You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in. @@ -38,7 +40,7 @@ It also has clickable tiles that give visual cues on the overall health state of ## ATP alerts You can view the overall number of active ATP alerts from the last 30 days in your network from the **ATP alerts** tile. Alerts are grouped into **New** and **In progress**. -![Click on each slice or severity to see a list of alerts from the past 30 days](images/atp.png) +![Click on each slice or severity to see a list of alerts from the past 30 days](images/atp-alerts-tile.png) Each group is further sub-categorized into their corresponding alert severity levels. Click the number of alerts inside each alert ring to see a sorted view of that category's queue (**New** or **In progress**). @@ -51,9 +53,9 @@ This tile shows you a list of machines with the highest number of active alerts. ![The Machines at risk tile shows a list of machines with the highest number of alerts, and a breakdown of the severity of the alerts](images/atp-machines-at-risk.png) -Click the name of the machine to see details about that machine. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md). +Click the name of the machine to see details about that machine. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines list](investigate-machines-windows-defender-advanced-threat-protection.md). -You can also click **Machines list** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md). +You can also click **Machines list** at the top of the tile to go directly to the **Machines list**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines list](investigate-machines-windows-defender-advanced-threat-protection.md). ## Users at risk The tile shows you a list of user accounts with the most active alerts. The total number of alerts for each user is shown in a circle next to the user account, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to see its label). @@ -69,19 +71,20 @@ Active malware is defined as threats that were actively executing at the time of Hover over each bar to see the number of active malware detections (as **Malware detections**) and the number of endpoints with at least one active detection (as **Machines**) over the past 30 days. -![The Machines with active malware detections tile shows the number of threats and machines for each threat category](images/machines-active-threats-tile.png) +![The Machines with active malware detections tile shows the number of threats and machines for each threat category](images/atp-machines-active-threats-tile.png) The chart is sorted into five categories: -- **Password stealer** - threats that attempt to steal credentials. - **Ransomware** - threats that prevent user access to a machine or its files and demand payment to restore access. +- **Credential theft** - threats that attempt to steal credentials. - **Exploit** - threats that use software vulnerabilities to infect machines. -- **Threat** - all other threats that don't fit into the **Password stealer**, **Ransomware**, or **Exploit** categories. This includes trojans, worms, backdoors, and viruses. -- **Low severity** - threats with low severity, including adware and potentially unwanted software such as browser modifiers. +- **Backdoor** - threats that gives a malicious hacker access to and control of machines. +- **General** - threats that perform unwanted actions, including actions that can disrupt, cause direct damage, and facilitate intrusion and data theft. +- **PUA** - applications that install and perform undesirable activity without adequate user consent. Threats are considered "active" if there is a very high probability that the malware was executing on your network, as opposed to statically located on-disk. -Clicking on any of these categories will navigate to the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. +Clicking on any of these categories will navigate to the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine. > [!NOTE] > The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender Antivirus](https://technet.microsoft.com/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product. @@ -93,21 +96,21 @@ The **Sensor health** tile provides information on the individual endpoint’s a There are two status indicators that provide information on the number of machines that are not reporting properly to the service: - **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month. -- **Misconfigured** – These machines might partially be reporting telemetry to the Windows Defender ATP service and might have configuration errors that need to be corrected. +- **Misconfigured** – These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected. -When you click any of the groups, you’ll be directed to machines list, filtered according to your choice. For more information, see [Check sensor health state](check-sensor-status-windows-defender-advanced-threat-protection.md) and [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md). +When you click any of the groups, you’ll be directed to machines list, filtered according to your choice. For more information, see [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) and [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md). ## Service health The **Service health** tile informs you if the service is active or if there are issues. ![The Service health tile shows an overall indicator of the service](images/status-tile.png) -For more information on the service status, see [Check the Windows Defender ATP service status](service-status-windows-defender-advanced-threat-protection.md). +For more information on the service health, see [Check the Windows Defender ATP service health](service-status-windows-defender-advanced-threat-protection.md). ## Daily machines reporting The **Daily machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily in the last 30 days. Hover over individual bars on the graph to see the exact number of machines reporting in each day. -![The Machines reporting tile shows the number of machines reporting each day for the past 30 days](images/machines-reporting-tile.png) +![Image of daily machines reporting tile](images/atp-daily-machines-reporting.png) ## Related topics - [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md) @@ -115,8 +118,8 @@ The **Daily machines reporting** tile shows a bar graph that represents the numb - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP ](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md index 073acf1b34..a74dd4b020 100644 --- a/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md @@ -134,7 +134,7 @@ This step will guide you in simulating an event in connection to a malicious IP ## Step 4: Explore the custom alert in the portal This step will guide you in exploring the custom alert in the portal. -1. Open the [Windows Defender ATP portal](http: /securitycenter.windows.com/) on a browser. +1. Open the [Windows Defender ATP portal](http://securitycenter.windows.com/) on a browser. 2. Log in with your Windows Defender ATP credentials. diff --git a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md index a301137ca4..8b5493c587 100644 --- a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md @@ -36,7 +36,7 @@ A reinstalled or renamed machine will generate a new machine entity in Windows D **Machine was offboarded**
If the machine was offboarded it will still appear in machines list. After 7 days, the machine health state should change to inactive. -Do you expect a machine to be in ‘Active’ status? [Open a CSS ticket](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561). +Do you expect a machine to be in ‘Active’ status? [Open a support ticket ticket](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561). ## Misconfigured machines Misconfigured machines can further be classified to: diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png b/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png new file mode 100644 index 0000000000..61ff260c38 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-alerts-queue-user.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png b/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png new file mode 100644 index 0000000000..8cf482904e Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-alerts-selected.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alerts-tile.png b/windows/threat-protection/windows-defender-atp/images/atp-alerts-tile.png new file mode 100644 index 0000000000..ed3cf79941 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-alerts-tile.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png b/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png new file mode 100644 index 0000000000..2b0253847e Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-alertsq2.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png b/windows/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png index dd7fe7dc4d..f62d84df10 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png and b/windows/threat-protection/windows-defender-atp/images/atp-azure-ui-user-access.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png b/windows/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png new file mode 100644 index 0000000000..e46f058e86 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-daily-machines-reporting.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machines-active-threats-tile.png b/windows/threat-protection/windows-defender-atp/images/atp-machines-active-threats-tile.png new file mode 100644 index 0000000000..fd0625088a Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-machines-active-threats-tile.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png b/windows/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png index 219e958d7d..cfa3cbda3e 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png and b/windows/threat-protection/windows-defender-atp/images/atp-machines-at-risk.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machines-list-misconfigured.png b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-misconfigured.png new file mode 100644 index 0000000000..3de8f88a28 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-misconfigured.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png new file mode 100644 index 0000000000..746d043732 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-machines-list-view.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-main-portal.png b/windows/threat-protection/windows-defender-atp/images/atp-main-portal.png index 2aa75b7dca..3336f8a1ac 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-main-portal.png and b/windows/threat-protection/windows-defender-atp/images/atp-main-portal.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png b/windows/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png index b82d66a85a..1face3083d 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png and b/windows/threat-protection/windows-defender-atp/images/atp-sensor-health-filter.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-users-at-risk.png b/windows/threat-protection/windows-defender-atp/images/atp-users-at-risk.png index cd43cdf607..c2b81ca99a 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-users-at-risk.png and b/windows/threat-protection/windows-defender-atp/images/atp-users-at-risk.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/components.png b/windows/threat-protection/windows-defender-atp/images/components.png index 840f1cb0df..04ab864727 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/components.png and b/windows/threat-protection/windows-defender-atp/images/components.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/rules-legend.png b/windows/threat-protection/windows-defender-atp/images/rules-legend.png index a48783c6e3..7739ccfda2 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/rules-legend.png and b/windows/threat-protection/windows-defender-atp/images/rules-legend.png differ diff --git a/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md index 58805fa39c..e456a18096 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md @@ -79,8 +79,8 @@ Selecting an alert detail brings up the **Details pane** where you'll be able to - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md index d0e04eabe5..b107b3b042 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md @@ -49,8 +49,8 @@ The **Communication with URL in organization** section provides a chronological - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md index e45a3d17d3..ebf5a67b89 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md @@ -57,8 +57,8 @@ This allows for greater accuracy in defining entities to display such as if and - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md index 1b792ae89e..b531ee93f6 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md @@ -57,8 +57,8 @@ Clicking any of the machine names will take you to that machine's view, where yo - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md index 5073e541f6..0c4eaeb6e2 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md @@ -1,6 +1,6 @@ --- -title: Investigate machines in the Windows Defender ATP Machines view -description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines view. +title: Investigate machines in the Windows Defender ATP Machines list +description: Investigate affected machines in your network by reviewing alerts, network connection information, and service health on the Machines list. keywords: machines, endpoints, machine, endpoint, alerts queue, alerts, machine name, domain, last seen, internal IP, active alerts, threat category, filter, sort, review alerts, network, connection, type, password stealer, ransomware, exploit, threat, low severity search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -11,7 +11,7 @@ author: mjcaparas localizationpriority: high --- -# Investigate machines in the Windows Defender ATP Machines view +# Investigate machines in the Windows Defender ATP Machines list **Applies to:** @@ -26,7 +26,7 @@ Investigate the details of an alert raised on a specific machine to identify oth You can click on affected machines whenever you see them in the portal to open a detailed report about that machine. Affected machines are identified in the following areas: -- The [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- The [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - The [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) - The [Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - Any individual alert @@ -97,7 +97,7 @@ You can also export detailed event data from the machine timeline to conduct off ### Navigate between pages Use the events per page drop-down to choose the number of alerts you’d like to see on the page. You can choose to display 20, 50, or 100 events per page. You can also move between pages by clicking **Older** or **Newer**. -From the **Machines view**, you can also navigate to the file, IP, or URL view and the timeline associated with an alert is retained, helping you view the investigation from different angles and retain the context of the event time line. +From the **Machines list**, you can also navigate to the file, IP, or URL view and the timeline associated with an alert is retained, helping you view the investigation from different angles and retain the context of the event time line. From the list of events that are displayed in the timeline, you can examine the behaviors or events in to help identify indicators of interests such as files and IP addresses to help determine the scope of a breach. You can then use the information to respond to events and keep your system secure. @@ -117,7 +117,7 @@ This enhances the ‘in-context’ information across investigation and explorat - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md index e0b1346b9e..9f45aa0817 100644 --- a/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md @@ -69,7 +69,7 @@ You can filter the results by the following time periods: - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md index 4f1523a324..9dd0f7d8b2 100644 --- a/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md @@ -105,7 +105,7 @@ Each rule shows: - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 6eb46cb27f..82efa42cc1 100644 --- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -41,9 +41,9 @@ For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us ### Network and data storage and configuration requirements When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: either in a European or United States datacenter. -> **Notes**   -- You cannot change your data storage location after the first-time setup. -- Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. +> [!NOTE] +> - You cannot change your data storage location after the first-time setup. +> - Review the [Windows Defender ATP data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) for more information on where and how Microsoft stores your data. ### Endpoint hardware and software requirements @@ -68,7 +68,7 @@ The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to com For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) . -Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10, but if it has been disabled you can turn it on by following the instructions in the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section. +Before you configure endpoints, the telemetry and diagnostics service must be enabled. The service is enabled by default in Windows 10. ### Telemetry and diagnostics settings You must ensure that the telemetry and diagnostics service is enabled on all the endpoints in your organization. diff --git a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md index 3e1b3c8a80..32b9dc366e 100644 --- a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md @@ -45,14 +45,15 @@ You can navigate through the portal using the menu options available in all sect Area | Description :---|:--- (1) Search bar, Feedback, Settings, Help and support | **Search** - Provides access to the search bar where you can search for file, IP, machine, URL, and user. Displays the Search box: the drop-down list allows you to select the entity type and then enter the search query text.
**Feedback** -Access the feedback button to provide comments about the portal.
**Settings** - Gives you access to the configuration settings where you can set time zones, alert suppression rules, and license information.
**Help and support** - Gives you access to the Windows Defender ATP guide, Microsoft support, and Premier support. -(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines view**, **Service health**, **Preferences setup**, and **Enpoint Management**. +(2) Navigation pane | Use the navigation pane to move between the **Dashboard**, **Alerts queue**, **Machines list**, **Service health**, **Preferences setup**, and **Endpoint management**. +(3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines list. **Dashboard** | Provides clickable tiles that open detailed information on various alerts that have been detected in your organization. **Alerts queue** | Enables you to view separate queues of new, in progress, and resolved alerts. -**Machines view** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. -**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service status is healthy or if there are current issues. +**Machines list** | Displays the list of machines that are onboarded to Windows Defender ATP, some information about them, and the corresponding number of alerts. +**Service health** | Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. **Preferences setup** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set email notifications, activate the preview experience, and enable or turn off advanced features. -**Endpoint Management** | Allows you to download the onboarding configuration package. It provides access to endpoint offboarding. -(3) Main portal| Main area where you will see the different views such as the Dashboard, Alerts queue, and Machines view. +**Endpoint management** | Allows you to download the onboarding configuration package. It provides access to endpoint offboarding. + ## Windows Defender ATP icons The following table provides information on the icons used all throughout the portal: diff --git a/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md index dab6725222..e2904380b5 100644 --- a/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md @@ -30,3 +30,5 @@ Topic | Description [Enable advanced features](advanced-features-windows-defender-advanced-threat-protection.md)| Enable features such as **Block file** and other features that require integration with other products. [Enable the preview experience](preview-settings-windows-defender-advanced-threat-protection.md) | Allows you to turn on preview features so you can try upcoming features. [Configure email notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) | Enables you to configure and identify a group of individuals who will immediately be informed of new alerts through email notifications. +[Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) | Enable security information and event management (SIEM) integration to pull alerts from the Windows Defender ATP portal using your SIEM solution. +[Enable Threat intel API](enable-custom-ti-windows-defender-advanced-threat-protection.md) | Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application. diff --git a/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md index a22e882c62..597cefb9a1 100644 --- a/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md @@ -40,7 +40,7 @@ Topic | Description - [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md) - [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md) - [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md) -- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md) -- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) +- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) - [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md) - [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md index 6c8623a564..088b4ed61a 100644 --- a/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md @@ -1,7 +1,7 @@ --- -title: Check the Windows Defender ATP service status -description: Check Windows Defender ATP service status, see if the service is experiencing issues and review previous issues that have been resolved. -keywords: dashboard, service, issues, service status, current issues, status history, summary of impact, preliminary root cause, resolution, resolution time, expected resolution time +title: Check the Windows Defender ATP service health +description: Check Windows Defender ATP service health, see if the service is experiencing issues and review previous issues that have been resolved. +keywords: dashboard, service, issues, service health, current issues, status history, summary of impact, preliminary root cause, resolution, resolution time, expected resolution time search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy @@ -11,7 +11,7 @@ author: mjcaparas localizationpriority: high --- -# Check the Windows Defender Advanced Threat Protection service status +# Check the Windows Defender Advanced Threat Protection service health **Applies to:** @@ -21,11 +21,11 @@ localizationpriority: high - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) -The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service status is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time. +The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time. You'll also see information on historical issues that have been resolved and details such as the date and time when the issue was resolved. When there are no issues on the service, you'll see a healthy status. -You can view details on the service status by clicking the tile from the **Dashboard** or selecting the **Service health** menu from the navigation pane. +You can view details on the service health by clicking the tile from the **Dashboard** or selecting the **Service health** menu from the navigation pane. The **Service health** details page has the following tabs: @@ -33,7 +33,7 @@ The **Service health** details page has the following tabs: - **Status History** ## Current issues -The **Current issues** tab shows the current state of the Windows Defender ATP service. When the service is running smoothly a healthy service status is shown. If there are issues seen, the following service details are shown to help you gain better insight about the issue: +The **Current issues** tab shows the current state of the Windows Defender ATP service. When the service is running smoothly a healthy service health is shown. If there are issues seen, the following service details are shown to help you gain better insight about the issue: - Date and time for when the issue was detected - A short description of the issue diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 85ad29fad8..6e7445cde4 100644 --- a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -24,12 +24,12 @@ localizationpriority: high You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues. This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints. -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an endpoint onboarding or connectivity problem. +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, it might indicate an endpoint onboarding or connectivity problem. ## Troubleshoot onboarding when deploying with Group Policy Deployment with Group Policy is done by running the onboarding script on the endpoints. The Group Policy console does not indicate if the deployment has succeeded or not. -If you have completed the endpoint onboarding process and don't see endpoints in the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). +If you have completed the endpoint onboarding process and don't see endpoints in the [Machines list](investigate-machines-windows-defender-advanced-threat-protection.md) after an hour, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). If the script completes successfully, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. @@ -43,7 +43,7 @@ When onboarding endpoints using the following versions of System Center Configur Deployment with the above-mentioned versions of System Center Configuration Manager is done by running the onboarding script on the endpoints. You can track the deployment in the Configuration Manager Console. -If the deployment fails, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint). +If the deployment fails, you can check the output of the script on the endpoints. If the onboarding completed successfully but the endpoints are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur. @@ -64,7 +64,7 @@ Event ID | Error Type | Resolution steps :---|:---|:--- 5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```. 10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically
```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.
Verify that the script was ran as an administrator. -15 | Failed to start SENSE service |Check the service status (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). +15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights). 15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender ELAM driver, see [Ensure that Windows Defender is not disabled by a policy](#ensure-that-windows-defender-is-not-disabled-by-a-policy) for instructions. 30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). 35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location
```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.
The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). @@ -82,13 +82,13 @@ Use the following tables to understand the possible causes of issues while onboa - Known issues with non-compliance table - Mobile Device Management (MDM) event logs table -If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint Management** section of the portal, and run it in an elevated command prompt. +If none of the event logs and troubleshooting steps work, download the Local script from the **Endpoint management** section of the portal, and run it in an elevated command prompt. **Microsoft Intune error codes and OMA-URIs**: Error Code Hex | Error Code Dec | Error Description | OMA-URI | Possible cause and troubleshooting steps :---|:---|:---|:---|:--- -0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

**Troubleshooting steps:**
Check the event IDs in the [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section.

Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx). +0x87D1FDE8 | -2016281112 | Remediation failed | Onboarding
Offboarding | **Possible cause:** Onboarding or offboarding failed on a wrong blob: wrong signature or missing PreviousOrgIds fields.

**Troubleshooting steps:**
Check the event IDs in the [View agent onboarding errors in the endpoint event log](#view-agent-onboarding-errors-in-the-endpoint-event-log) section.

Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx). | | | Onboarding
Offboarding
SampleSharing | **Possible cause:** Windows Defender ATP Policy registry key does not exist or the OMA DM client doesn't have permissions to write to it.

**Troubleshooting steps:** Ensure that the following registry key exists: ```HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```.

If it doesn't exist, open an elevated command and add the key. | | | SenseIsRunning
OnboardingState
OrgId | **Possible cause:** An attempt to remediate by read-only property. Onboarding has failed.

**Troubleshooting steps:** Check the troubleshooting steps in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](#troubleshoot-windows-defender-advanced-threat-protection-onboarding-issues).

Check the MDM event logs in the following table or follow the instructions in [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/library/windows/hardware/mt632120%28v=vs.85%29.aspx). | | | All | **Possible cause:** Attempt to deploy Windows Defender ATP on non-supported SKU/Platform, particularly Holographic SKU.

Currently is supported platforms: Enterprise, Education, and Professional.
Server is not supported. diff --git a/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md index e614c969ca..6b8436e6ef 100644 --- a/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md @@ -44,7 +44,7 @@ Topic | Description [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) | Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external Internet protocol (IP) addresses. [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. -[View and organize the Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md)| You can sort, filter, and exporting the machine list. +[View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)| You can sort, filter, and exporting the machine list. [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines list** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats. [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md)| Investigate user accounts with the most active alerts. [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert. diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md index 5bcc8e1a05..3b756a14c7 100644 --- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md +++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md @@ -342,6 +342,9 @@ After you've added the apps you want to protect with WIP, you'll need to apply a We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**. +>[!NOTE] +>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + **To add your protection mode** 1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears. @@ -353,7 +356,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi |Mode |Description | |-----|------------| |Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| - |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459).| + |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| diff --git a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md index 59a4720f61..4dbf46f1e8 100644 --- a/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -339,10 +339,13 @@ After you've added the apps you want to protect with WIP, you'll need to apply a We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. +>[!NOTE] +>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + |Mode |Description | |-----|------------| |Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| -|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. | |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| diff --git a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md index d00786a7cf..19071542aa 100644 --- a/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -82,7 +82,8 @@ WIP gives you a new way to manage data policy enforcement for apps and documents You don’t have to modify line-of-business apps that never touch personal data to list them as allowed apps; just include them in the allowed apps list. - - **Deciding your level of data access.** WIP lets you hide overrides, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. + - **Deciding your level of data access.** WIP lets you hide overrides, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + - **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media. @@ -123,18 +124,18 @@ Enterprise data is automatically encrypted after it’s loaded on a device from Your WIP policy includes a list of trusted apps that are allowed to access and process corporate data. This list of apps is implemented through the [AppLocker](/windows/device-security/applocker/applocker-overview) functionality, controlling what apps are allowed to run and letting the Windows operating system know that the apps can edit corporate data. Apps included on this list don’t have to be modified to open corporate data because their presence on the list allows Windows to determine whether to grant them access. However, new for Windows 10, app developers can use a new set of application programming interfaces (APIs) to create *enlightened* apps that can use and edit both enterprise and personal data. A huge benefit to working with enlightened apps is that dual-use apps, like Microsoft Word, can be used with less concern about encrypting personal data by mistake because the APIs allow the app to determine whether data is owned by the enterprise or if it’s personally owned. +>[!NOTE] +>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + You can set your WIP policy to use 1 of 4 protection and management modes: |Mode|Description| |----|-----------| |Hide overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| -|Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.| |Silent |WIP runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.

**Note**
For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. | ->[!NOTE] ->For info about how to collect your audit logs, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). - ## Turn off WIP You can turn off all Windows Information Protection and restrictions, decrypting all devices managed by WIP and reverting to where you were pre-WIP, with no data loss. However, this isn’t recommended. If you choose to turn WIP off, you can always turn it back on, but your decryption and policy info won’t be automatically reapplied.