mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 05:37:22 +00:00
Merge branch 'main' of https://github.com/MicrosoftDocs/windows-docs-pr into do-landing
This commit is contained in:
greg-lindsay
commit
b7450c4059
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.date: 01/03/2022
|
||||
ms.date: 03/02/2022
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.collection: highpri
|
||||
@ -47,14 +47,15 @@ In Windows 10, version 1709 or later, when the same policy is configured in GP a
|
||||
For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices.
|
||||
|
||||
## Verify auto-enrollment requirements and settings
|
||||
|
||||
To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly.
|
||||
The following steps demonstrate required settings using the Intune service:
|
||||
|
||||
1. Verify that the user who is going to enroll the device has a valid Endpoint Protection Manager license.
|
||||
1. Verify that the user who is going to enroll the device has a valid [Intune license](/mem/intune/fundamentals/licenses).
|
||||
|
||||
:::image type="content" alt-text="Intune license verification." source="images/auto-enrollment-intune-license-verification.png" lightbox="images/auto-enrollment-intune-license-verification.png":::
|
||||
|
||||
2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM). For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md).
|
||||
2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/11/2021
|
||||
ms.date: 03/01/2022
|
||||
---
|
||||
|
||||
# Policies in Policy CSP supported by HoloLens 2
|
||||
@ -120,7 +120,6 @@ ms.date: 10/11/2021
|
||||
- [Update/ScheduleRestartWarning](policy-csp-update.md#update-schedulerestartwarning) <sup>10</sup>
|
||||
- [Update/SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess)
|
||||
- [Update/UpdateNotificationLevel](policy-csp-update.md#update-updatenotificationlevel) <sup>10</sup>
|
||||
- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl)
|
||||
- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration)
|
||||
- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) <sup>8</sup>
|
||||
|
||||
|
||||
@ -64,7 +64,7 @@ ms.date: 07/22/2020
|
||||
- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap)
|
||||
- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth)
|
||||
- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders)
|
||||
- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md)
|
||||
- [RestrictedGroups/ConfigureGroupMembership](policy-csp-restrictedgroups.md#restrictedgroups-configuregroupmembership)
|
||||
- [System/AllowLocation](policy-csp-system.md#system-allowlocation)
|
||||
- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard)
|
||||
- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry)
|
||||
@ -79,11 +79,12 @@ ms.date: 07/22/2020
|
||||
- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208)
|
||||
- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc)
|
||||
- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis)
|
||||
- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone)
|
||||
- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing)
|
||||
- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration)
|
||||
- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi)
|
||||
- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting)
|
||||
- [WiFi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode)
|
||||
- [Wifi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting)
|
||||
- [Wifi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode)
|
||||
- [Wifi/AllowWiFiDirect](policy-csp-wifi.md#wifi-allowwifidirect)
|
||||
- [WirelessDisplay/AllowMdnsAdvertisement](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsadvertisement)
|
||||
- [WirelessDisplay/AllowMdnsDiscovery](policy-csp-wirelessdisplay.md#wirelessdisplay-allowmdnsdiscovery)
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.date: 03/03/2022
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -1084,15 +1084,15 @@ The following list shows the supported values:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether the emoji button is enabled or disabled for the touch keyboard. When this policy is set to disabled, the emoji button on touch keyboard is disabled.
|
||||
Specifies whether the emoji, GIF (only in Windows 11), and kaomoji (only in Windows 11) buttons are available or unavailable for the touch keyboard. When this policy is set to disabled, the buttons are hidden and unavailable.
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) - The OS determines when it's most appropriate to be available.
|
||||
- 1 - Emoji button on keyboard is always available.
|
||||
- 2 - Emoji button on keyboard is always disabled.
|
||||
- 0 (default) - The OS determines when buttons are most appropriate to be available.
|
||||
- 1 - Emoji, GIF, and Kaomoji buttons on the touch keyboard are always available.
|
||||
- 2 - Emoji, GIF, and Kaomoji buttons on the touch keyboard are always unavailable.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -14,20 +14,49 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 12/06/2018
|
||||
ms.date: 03/01/2022
|
||||
ms.technology: windows-sec
|
||||
---
|
||||
|
||||
# Querying Application Control events centrally using Advanced hunting
|
||||
|
||||
A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode.
|
||||
While Event Viewer helps to see the impact on a single system, IT Pros want to gauge the impact across many systems.
|
||||
While Event Viewer helps to see the impact on a single system, IT Pros want to gauge it across many systems.
|
||||
|
||||
In November 2018, we added functionality in Microsoft Defender for Endpoint that makes it easy to view WDAC events centrally from all systems that are connected to Defender for Endpoint.
|
||||
In November 2018, we added functionality in Microsoft Defender for Endpoint that makes it easy to view WDAC events centrally from all connected systems.
|
||||
|
||||
Advanced hunting in Microsoft Defender for Endpoint allows customers to query data using a rich set of capabilities. WDAC events can be queried with using an ActionType that starts with “AppControl”.
|
||||
This capability is supported beginning with Windows version 1607.
|
||||
|
||||
## Action Types
|
||||
|
||||
| ActionType Name | ETW Source Event ID | Description |
|
||||
| - | - | - |
|
||||
| AppControlCodeIntegrityDriverRevoked | 3023 | The driver file under validation didn't meet the requirements to pass the application control policy. |
|
||||
| AppControlCodeIntegrityImageRevoked | 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. |
|
||||
| AppControlCodeIntegrityPolicyAudited | 3076 | This event is the main WDAC block event for audit mode policies. It indicates the file would have been blocked if the WDAC policy was enforced. |
|
||||
| AppControlCodeIntegrityPolicyBlocked | 3077 | This event is the main WDAC block event for enforced policies. It indicates the file didn't pass your WDAC policy and was blocked. |
|
||||
| AppControlExecutableAudited | 8003 | Applied only when the Audit only enforcement mode is enabled. Specifies the .exe or .dll file would be blocked if the Enforce rules enforcement mode were enabled. |
|
||||
| AppControlExecutableBlocked | 8004 | The .exe or .dll file can't run. |
|
||||
| AppControlPackagedAppAudited | 8021 | Applied only when the Audit only enforcement mode is enabled. Specifies the packaged app would be blocked if the Enforce rules enforcement mode were enabled. |
|
||||
| AppControlPackagedAppBlocked | 8022 | The packaged app was blocked by the policy. |
|
||||
| AppControlScriptAudited | 8006 | Applied only when the Audit only enforcement mode is enabled. Specifies the script or .msi file would be blocked if the Enforce rules enforcement mode were enabled. |
|
||||
| AppControlScriptBlocked | 8007 | Access to file name is restricted by the administrator. Applied only when the Enforce rules enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file can't run. |
|
||||
| AppControlCIScriptAudited | 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the script hosts themselves. |
|
||||
| AppControlCIScriptBlocked | 8029 | Block script/MSI file generated by Windows LockDown Policy (WLDP) being called by the script hosts themselves. |
|
||||
| AppControlCodeIntegrityOriginAllowed | 3090 | File was allowed due to good reputation (ISG) or installation source (managed installer). |
|
||||
| AppControlCodeIntegrityOriginAudited | 3091 | Reputation (ISG) and installation source (managed installer) information for an audited file. |
|
||||
| AppControlCodeIntegrityOriginBlocked | 3092 | Reputation (ISG) and installation source (managed installer) information for a blocked file. |
|
||||
| AppControlCodeIntegrityPolicyLoaded | 3099 | Indicates a policy has been successfully loaded. |
|
||||
| AppControlCodeIntegritySigningInformation | 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. |
|
||||
| AppControlPolicyApplied | 8001 | Indicates the AppLocker policy was successfully applied to the computer. |
|
||||
|
||||
Learn more about the [Understanding Application Control event IDs (Windows)](event-id-explanations.md)
|
||||
|
||||
## Example Advanced Hunting Application Control Queries
|
||||
|
||||
Query Example 1: Query the application control action types summarized by type for past seven days
|
||||
|
||||
Here's a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Microsoft Defender for Endpoint:
|
||||
|
||||
```
|
||||
@ -41,6 +70,28 @@ ActionType startswith "AppControl"
|
||||
The query results can be used for several important functions related to managing WDAC including:
|
||||
|
||||
- Assessing the impact of deploying policies in audit mode
|
||||
Since applications still run in audit mode, it's an ideal way to see the impact and correctness of the rules included in the policy. Integrating the generated events with Advanced hunting makes it much easier to have broad deployments of audit mode policies and see how the included rules would impact those systems in real-world usage. This audit mode data will help streamline the transition to using policies in enforced mode.
|
||||
Since applications still run in audit mode, it's an ideal way to see the impact and correctness of the rules included in the policy. Integrating the generated events with Advanced Hunting makes it much easier to have broad deployments of audit mode policies and see how the included rules would influence those systems in real world usage. This audit mode data will help streamline the transition to using policies in enforced mode.
|
||||
- Monitoring blocks from policies in enforced mode
|
||||
Policies deployed in enforced mode may block executables or scripts that fail to meet any of the included allow rules. Legitimate new applications and updates or potentially unwanted or malicious software could be blocked. In either case, the Advanced hunting queries report the blocks for further investigation.
|
||||
|
||||
|
||||
Query Example #2: Query to determine audit blocks in the past seven days
|
||||
|
||||
```
|
||||
DeviceEvents
|
||||
| where ActionType startswith "AppControlExecutableAudited"
|
||||
| where Timestamp > ago(7d)
|
||||
|project DeviceId, // the device ID where the audit block happened
|
||||
FileName, // The audit blocked app's filename
|
||||
FolderPath, // The audit blocked app's system path without the FileName
|
||||
InitiatingProcessFileName, // The file name of the parent process loading the executable
|
||||
InitiatingProcessVersionInfoCompanyName, // The company name of the parent process loading the executable
|
||||
InitiatingProcessVersionInfoOriginalFileName, // The original file name of the parent process loading the executable
|
||||
InitiatingProcessVersionInfoProductName, // The product name of the parent process loading the executable
|
||||
InitiatingProcessSHA256, // The SHA256 flat hash of the parent process loading the executable
|
||||
Timestamp, // The event creation timestamp
|
||||
ReportId, // The report ID - randomly generated by MDE AH
|
||||
InitiatingProcessVersionInfoProductVersion, // The product version of the parent process loading the executable
|
||||
InitiatingProcessVersionInfoFileDescription, // The file description of the parent process loading the executable
|
||||
AdditionalFields // Additional fields contains FQBN for signed binaries. These contain the CN of the leaf certificate, product name, original filename and version of the audited binary
|
||||
```
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user