mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/master' into rs4
This commit is contained in:
Jeanie Decker
commit
b87f079372
@ -14,7 +14,7 @@ ms.date: 04/23/2017
|
||||
# How to Enable BitLocker by Using MBAM as Part of a Windows Deployment
|
||||
|
||||
|
||||
This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process.
|
||||
This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process. If you see a black screen at restart (after Install phase concludes) indicating that the drive cannot be unlocked, see [Windows versions prior Windows 10 build 1511 fail to start after "Setup Windows and Configuration Manager" step when Pre-Provision BitLocker is used with Windows PE 10.0.586.0 (1511)](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2016/03/30/windows-versions-prior-windows-10-build-1511-fail-to-start-after-setup-windows-and-configuration-manager-step-when-pre-provision-bitlocker-is-used-with-windows-pe-10-0-586-0-1511/).
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
@ -59,7 +59,7 @@ This topic explains how to enable BitLocker on an end user's computer by using M
|
||||
|
||||
- Robust error handling
|
||||
|
||||
You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=48698). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server.
|
||||
You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=54439). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server.
|
||||
|
||||
**WMI deployment methods for MBAM:** The following WMI methods have been added in MBAM 2.5 SP1 to support enabling BitLocker by using the `Invoke-MbamClientDeployment.ps1` PowerShell script.
|
||||
|
||||
|
||||
@ -112,7 +112,7 @@ The following image shows the EnterpriseModernAppManagement configuration servic
|
||||
</Replace>
|
||||
```
|
||||
<a href="" id="appmanagement-removepackage"></a>**AppManagement/RemovePackage**
|
||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. Used to remove packages.
|
||||
<p style="margin-left: 20px">Added in Windows 10, version 1703. Used to remove packages. Not supported for ./User/Vendor/MSFT.
|
||||
|
||||
<p style="margin-left: 20px">Parameters:
|
||||
<ul>
|
||||
@ -121,34 +121,18 @@ The following image shows the EnterpriseModernAppManagement configuration servic
|
||||
<li>Name: Specifies the PackageFullName of the particular package to remove.</li>
|
||||
<li>RemoveForAllUsers:
|
||||
<ul>
|
||||
<li>0 (default) – Package will be un-provisioned so that new users do not receive the package. The package will remain installed for current users.</li>
|
||||
<li>1 – Package will be removed for all users.</li>
|
||||
<li>0 (default) – Package will be un-provisioned so that new users do not receive the package. The package will remain installed for current users. This is not currently supported.</li>
|
||||
<li>1 – Package will be removed for all users only if it is a provisioned package.</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li>User (optional): Specifies the SID of the particular user for whom to remove the package; only the package for the specified user can be removed. Not required for ./User/Vendor/MSFT.</li>
|
||||
<li>User (optional): Specifies the SID of the particular user for whom to remove the package; only the package for the specified user can be removed.</li>
|
||||
</ul>
|
||||
|
||||
|
||||
<p style="margin-left: 20px">Supported operation is Execute.
|
||||
|
||||
<p style="margin-left: 20px">The following example removes a package for the specified user:
|
||||
|
||||
```XML
|
||||
<Exec>
|
||||
<CmdID>10</CmdID>
|
||||
<Item>
|
||||
<Target>
|
||||
<LocURI>./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/RemovePackage</LocURI>
|
||||
</Target>
|
||||
<Meta><Format xmlns="syncml:metinf">xml</Format></Meta>
|
||||
<Data>
|
||||
<Package Name= "{PackageFullName}"/>
|
||||
</Data>
|
||||
</Item>
|
||||
</Exec>
|
||||
```
|
||||
<p style="margin-left: 20px">The following example removes a package for all users:
|
||||
|
||||
````XML
|
||||
@ -307,7 +291,12 @@ The following image shows the EnterpriseModernAppManagement configuration servic
|
||||
<p style="margin-left: 20px">Supported operation is Get.
|
||||
|
||||
<a href="" id="----packagefamilyname-packagefullname-users"></a>**.../*PackageFamilyName*/*PackageFullName*/Users**
|
||||
<p style="margin-left: 20px">Required. Registered users of the app. If the query is at the device level, it returns all the registered users of the device. If you query the user context, it will only return the current user. Value type is string.
|
||||
<p style="margin-left: 20px">Required. Registered users of the app and the package install state. If the query is at the device level, it returns all the registered users of the device. If you query the user context, it will only return the current user. Value type is string.
|
||||
|
||||
- Not Installed = 0
|
||||
- Staged = 1
|
||||
- Installed = 2
|
||||
- Paused = 6
|
||||
|
||||
<p style="margin-left: 20px">Supported operation is Get.
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB After Width: | Height: | Size: 59 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 17 KiB After Width: | Height: | Size: 22 KiB |
@ -24,49 +24,49 @@ The following diagram shows the MultiSIM configuration service provider in tree
|
||||
<a href="" id="multisim"></a>**./Device/Vendor/MSFT/MultiSIM**
|
||||
Root node.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_**
|
||||
<a href="" id="modemid"></a>**_ModemID_**
|
||||
Node representing a Mobile Broadband Modem. The node name is the modem ID. Modem ID is a GUID without curly braces, with exception of "Embedded" which represents the embedded modem.
|
||||
|
||||
<a href="" id="modemid"></a>**_ModemID_/Identifier**
|
||||
<a href="" id="modemid-identifier"></a>**_ModemID_/Identifier**
|
||||
Modem ID.
|
||||
|
||||
Supported operation is Get. Value type is string.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/IsEmbedded**
|
||||
<a href="" id="modemid-isembedded"></a>**_ModemID_/IsEmbedded**
|
||||
Indicates whether this modem is embedded or external.
|
||||
|
||||
Supported operation is Get. Value type is bool.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots**
|
||||
<a href="" id="modemid-slots"></a>**_ModemID_/Slots**
|
||||
Represents all SIM slots in the Modem.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots/_SlotID_**
|
||||
<a href="" id="modemid-slots-slotid"></a>**_ModemID_/Slots/_SlotID_**
|
||||
Node representing a SIM Slot. The node name is the Slot ID. SIM Slot ID format is "0", "1", etc., with exception of "Embedded" which represents the embedded Slot.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots/_SlotID_/Identifier**
|
||||
<a href="" id="modemid-slots-slotid-identifier"></a>**_ModemID_/Slots/_SlotID_/Identifier**
|
||||
Slot ID.
|
||||
|
||||
Supported operation is Get. Value type is integer.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots/_SlotID_/IsEmbedded**
|
||||
<a href="" id="modemid-slots-slotid-isembedded"></a>**_ModemID_/Slots/_SlotID_/IsEmbedded**
|
||||
Indicates whether this Slot is embedded or a physical SIM slot.
|
||||
|
||||
Supported operation is Get. Value type is bool.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots/_SlotID_/IsSelected**
|
||||
<a href="" id="modemid-slots-slotid-isselected"></a>**_ModemID_/Slots/_SlotID_/IsSelected**
|
||||
Indicates whether this Slot is selected or not.
|
||||
|
||||
Supported operation is Get and Replace. Value type is bool.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Slots/_SlotID_/State**
|
||||
<a href="" id="modemid-slots-slotid-state"></a>**_ModemID_/Slots/_SlotID_/State**
|
||||
Slot state (Unknown = 0, OffEmpty = 1, Off = 2, Empty = 3, NotReady = 4, Active = 5, Error = 6, ActiveEsim = 7, ActiveEsimNoProfile = 8)
|
||||
|
||||
Supported operation is Get. Value type is integer.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Policies**
|
||||
<a href="" id="modemid-policies"></a>**_ModemID_/Policies**
|
||||
Policies associated with the Modem.
|
||||
|
||||
<a href="" id="tbd"></a>**_ModemID_/Policies/SlotSelectionEnabled**
|
||||
<a href="" id="modemid-policies-slotselectionenabled"></a>**_ModemID_/Policies/SlotSelectionEnabled**
|
||||
Determines whether the user is allowed to change slots in the Cellular settings UI. Default is true.
|
||||
|
||||
Supported operation is Get and Replace. Value type is bool.
|
||||
|
||||
@ -1329,16 +1329,16 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<<<<<<< HEAD
|
||||
<td style="vertical-align:top">[AccountManagement CSP](accountmanagement-csp.md)</td>
|
||||
<td style="vertical-align:top"><p>Added a new CSP in Windows 10, version 1803.</p>
|
||||
=======
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<td style="vertical-align:top">[RootCATrustedCertificates CSP](rootcacertificates-csp.md)</td>
|
||||
<td style="vertical-align:top"><p>Added the following node in Windows 10, version 1803:</p>
|
||||
<ul>
|
||||
<li>UntrustedCertificates</li>
|
||||
</ul>
|
||||
>>>>>>> 2aa0839b99c52229c7cf43d58f467019b1284a6a
|
||||
</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
@ -1608,6 +1608,31 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
|
||||
## Change history in MDM documentation
|
||||
|
||||
### April 2018
|
||||
|
||||
<table class="mx-tdBreakAll">
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="75%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>New or updated topic</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td style="vertical-align:top">[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)</td>
|
||||
<td style="vertical-align:top"><p>Added the following node in Windows 10, version 1803:</p>
|
||||
<ul>
|
||||
<li>Settings/AllowVirtualGPU</li>
|
||||
<li>Settings/SaveFilesToHost</li>
|
||||
</ul>
|
||||
</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### March 2018
|
||||
|
||||
<table class="mx-tdBreakAll">
|
||||
@ -1669,6 +1694,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
</ul>
|
||||
<p>The following existing policies were updated:</p>
|
||||
<ul>
|
||||
<li>Browser/AllowCookies - updated the supported values. There are 3 values - 0, 1, 2.</li>
|
||||
<li>InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML</li>
|
||||
<li>TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.</li>
|
||||
</ul>
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 03/13/2018
|
||||
ms.date: 03//2018
|
||||
---
|
||||
|
||||
# Policy CSP - Browser
|
||||
@ -445,8 +445,9 @@ ADMX Info:
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 – Not allowed.
|
||||
- 1 (default) – Allowed.
|
||||
- 0 – Block all cookies
|
||||
- 1 – Block only third party cookies
|
||||
- 2 - Allow cookies
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Validation-->
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 03/12/2018
|
||||
ms.date: 04/02/2018
|
||||
---
|
||||
|
||||
# Policy CSP - EventLogService
|
||||
@ -200,7 +200,7 @@ ADMX Info:
|
||||
<!--Description-->
|
||||
This policy setting specifies the maximum size of the log file in kilobytes.
|
||||
|
||||
If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
|
||||
If you enable this policy setting, you can configure the maximum log file size to be between 20 megabytes (20480 kilobytes) and 2 terabytes (2147483647 kilobytes) in kilobyte increments.
|
||||
|
||||
If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog and it defaults to 20 megabytes.
|
||||
|
||||
|
||||
@ -359,7 +359,7 @@ The following list shows the supported values:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), which is majority of the case for Intune, then disabling the MDM unenrollment has no effect.
|
||||
Specifies whether to allow the user to delete the workplace account using the workplace control panel. If the device is Azure Active Directory joined and MDM enrolled (e.g. auto-enrolled), then disabling the MDM unenrollment has no effect.
|
||||
|
||||
> [!NOTE]
|
||||
> The MDM server can always remotely delete the account.
|
||||
@ -1027,7 +1027,7 @@ The following list shows the supported values:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1083. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive.
|
||||
Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive.
|
||||
|
||||
- User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app.
|
||||
- User Setting is changeable on a per user basis.
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 03/12/2018
|
||||
ms.date: 04/03/2018
|
||||
---
|
||||
|
||||
# Policy CSP - KioskBrowser
|
||||
@ -14,6 +14,7 @@ ms.date: 03/12/2018
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
These policies only apply to kiosk browser.
|
||||
|
||||
<hr/>
|
||||
|
||||
@ -83,6 +84,9 @@ ms.date: 03/12/2018
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs.
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -127,6 +131,9 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to.
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -171,6 +178,9 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. Configures the default URL kiosk browsers to navigate on launch and restart.
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -215,6 +225,9 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. Enable/disable kiosk browser's home button.
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -259,6 +272,9 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button.
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation buttons (forward/back).
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
|
||||
@ -305,6 +321,9 @@ Added in Windows 10, version 1803. Amount of time in minutes the session is idle
|
||||
|
||||
The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser.
|
||||
|
||||
> [!Note]
|
||||
> This policy only applies to kiosk browser.
|
||||
|
||||
<!--/Description-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
@ -171,10 +171,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
@ -235,10 +235,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
@ -299,10 +299,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
@ -363,10 +363,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
@ -551,10 +551,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
@ -615,10 +615,10 @@ ADMX Info:
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
|
||||
@ -80,7 +80,7 @@ ms.date: 03/12/2018
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
@ -129,7 +129,7 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
@ -178,7 +178,7 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
@ -227,7 +227,7 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
@ -276,7 +276,7 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
@ -325,7 +325,7 @@ GP Info:
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automaic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
Added in Windows 10, version 1803. This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual.
|
||||
|
||||
<!--/Description-->
|
||||
<!--DbMapped-->
|
||||
|
||||
@ -7,7 +7,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 06/26/2017
|
||||
ms.date: 04/02/2017
|
||||
---
|
||||
|
||||
# VPN CSP
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 11/01/2017
|
||||
ms.date: 03/22/2018
|
||||
---
|
||||
|
||||
# WindowsDefenderApplicationGuard CSP
|
||||
@ -81,6 +81,18 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se
|
||||
- 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off.
|
||||
- 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.
|
||||
|
||||
<a href="" id="allowvirtualgpu"></a>**Settings/AllowVirtualGPU**
|
||||
Added in Windows 10, version 1803. This policy setting allows you to determine whether Application Guard can use the virtual GPU to process graphics. Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
- 0 (default) - Cannot access the vGPU and uses the CPU to support rendering graphics. When the policy is not configured, it is the same as disabled (0).
|
||||
- 1 - Turns on the functionality to access the vGPU offloading graphics rendering from the CPU. This can create a faster experience when working with graphics intense websites or watching video within the container.
|
||||
|
||||
<a href="" id="savefilestohost"></a>**Settings/SaveFilesToHost**
|
||||
Added in Windows 10, version 1803. This policy setting allows you to determine whether users can elect to download files from Edge in the container and persist files them from container to the host operating system. Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
- 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0).
|
||||
- 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system.
|
||||
|
||||
<a href="" id="status"></a>**Status**
|
||||
<p style="margin-left: 20px">Returns status on Application Guard installation and pre-requisites. Value type is integer. Supported operation is Get.</p>
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: nickbrower
|
||||
ms.date: 12/05/2017
|
||||
ms.date: 03/22/2018
|
||||
---
|
||||
|
||||
# WindowsDefenderApplicationGuard DDF file
|
||||
@ -16,6 +16,8 @@ This topic shows the OMA DM device description framework (DDF) for the **Windows
|
||||
|
||||
Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download).
|
||||
|
||||
This XML is for Windows 10, version 1803.
|
||||
|
||||
``` syntax
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE MgmtTree PUBLIC " -//OMA//DTD-DM-DDF 1.2//EN"
|
||||
@ -25,7 +27,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
|
||||
<VerDTD>1.2</VerDTD>
|
||||
<Node>
|
||||
<NodeName>WindowsDefenderApplicationGuard</NodeName>
|
||||
<Path>./Vendor/MSFT</Path>
|
||||
<Path>./Device/Vendor/MSFT</Path>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
@ -40,7 +42,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
|
||||
<Permanent />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>com.microsoft/1.1/MDM/WindowsDefenderApplicationGuard</MIME>
|
||||
<MIME>com.microsoft/1.2/MDM/WindowsDefenderApplicationGuard</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -200,6 +202,52 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>AllowVirtualGPU</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>SaveFilesToHost</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
<Add />
|
||||
<Delete />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Status</NodeName>
|
||||
@ -229,7 +277,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic
|
||||
<Exec />
|
||||
</AccessType>
|
||||
<DFFormat>
|
||||
<int />
|
||||
<chr />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
|
||||
@ -8,13 +8,19 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: high
|
||||
author: jdeckerms
|
||||
ms.date: 03/23/2018
|
||||
ms.date: 04/04/2018
|
||||
---
|
||||
|
||||
# Change history for Configure Windows 10
|
||||
|
||||
This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile.
|
||||
|
||||
## April 2018
|
||||
|
||||
New or changed topic | Description
|
||||
--- | ---
|
||||
[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Updated endpoints.
|
||||
|
||||
## March 2018
|
||||
|
||||
New or changed topic | Description
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: high
|
||||
author: brianlic-msft
|
||||
ms.date: 10/17/2017
|
||||
ms.date: 04/04/2018
|
||||
---
|
||||
|
||||
# Configure Windows diagnostic data in your organization
|
||||
@ -56,7 +56,7 @@ Windows diagnostic data is vital technical data from Windows devices about the d
|
||||
- Improve Windows – through the aggregate analysis of the use of Windows
|
||||
- Personalize Windows engagement surfaces
|
||||
|
||||
Here are some specific examples of Windows diagnostic data data:
|
||||
Here are some specific examples of Windows diagnostic data:
|
||||
|
||||
- Type of hardware being used
|
||||
- Applications installed and usage details
|
||||
@ -143,11 +143,17 @@ All diagnostic data data is encrypted using SSL and uses certificate pinning dur
|
||||
|
||||
The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
|
||||
|
||||
The following table defines the endpoints for diagnostic data services:
|
||||
The following table defines the endpoints for Connected User Experiences and Telemetry component:
|
||||
|
||||
Windows release | Endpoint
|
||||
--- | ---
|
||||
Windows 10, versions 1703 and 1709 | Diagnostics data: v10.vortex-win.data.microsoft.com/collect/v1</br></br>Functional: v20.vortex-win.data.microsoft.com/collect/v1</br>Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com/collect/v1</br>settings-win.data.microsoft.com
|
||||
Windows 10, version 1607 | v10.vortex-win.data.microsoft.com</br></br>settings-win.data.microsoft.com
|
||||
|
||||
The following table defines the endpoints for other diagnostic data services:
|
||||
|
||||
| Service | Endpoint |
|
||||
| - | - |
|
||||
| Connected User Experiences and Telemetry component | v10.vortex-win.data.microsoft.com<br />settings-win.data.microsoft.com |
|
||||
| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
|
||||
| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
|
||||
| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
|
||||
@ -167,7 +173,7 @@ The diagnostic data data is categorized into four levels:
|
||||
|
||||
- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
|
||||
|
||||
- **Basic**. Basic device info, including: quality-related data, app compatibility, app usage data, and data from the **Security** level.
|
||||
- **Basic**. Basic device info, including: quality-related data, app compatibility, and data from the **Security** level.
|
||||
|
||||
- **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels.
|
||||
|
||||
@ -188,7 +194,7 @@ Windows Server Update Services (WSUS) and System Center Configuration Manager fu
|
||||
|
||||
The data gathered at this level includes:
|
||||
|
||||
- **Connected User Experiences and Telemetry component settings**. If general diagnostic data data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
|
||||
- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
|
||||
|
||||
- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
|
||||
|
||||
@ -240,8 +246,6 @@ The data gathered at this level includes:
|
||||
|
||||
- **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage.
|
||||
|
||||
- **App usage data**. Includes how an app is used, including how long an app is used, when the app has focus, and when the app is started
|
||||
|
||||
- **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade.
|
||||
|
||||
- **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
|
||||
@ -322,9 +326,9 @@ However, before more data is gathered, Microsoft’s privacy governance team, in
|
||||
|
||||
Sharing diagnostic data data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option.
|
||||
|
||||
Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic, Enhanced, and Full. The Security level is not available.
|
||||
Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available.
|
||||
|
||||
IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy overrides users’ choices. The remainder of this section describes how to do that.
|
||||
IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this section describes how to use group policy to configure levels and settings interface.
|
||||
|
||||
|
||||
### Manage your diagnostic data settings
|
||||
@ -340,7 +344,7 @@ The lowest diagnostic data setting level supported through management policies i
|
||||
|
||||
### Configure the operating system diagnostic data level
|
||||
|
||||
You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy overrides any device level settings.
|
||||
You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
|
||||
|
||||
Use the appropriate value in the table below when you configure the management policy.
|
||||
|
||||
@ -351,6 +355,8 @@ Use the appropriate value in the table below when you configure the management p
|
||||
| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** |
|
||||
| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** |
|
||||
|
||||
> [!NOTE]
|
||||
> When the User Configuration policy is set for Diagnostic Data, this will override the Computer Configuration setting.
|
||||
|
||||
### Use Group Policy to set the diagnostic data level
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.localizationpriority: high
|
||||
ms.sitesec: library
|
||||
ms.pagetype: mdt
|
||||
author: mtniehaus
|
||||
ms.date: 11/09/2017
|
||||
ms.date: 04/03/2018
|
||||
---
|
||||
|
||||
# Create a Windows 10 reference image
|
||||
@ -20,7 +20,7 @@ ms.date: 11/09/2017
|
||||
Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution.
|
||||
For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, PC0001 is a Windows 10 Enterprise x64 client, and MDT01 is a Windows Server 2012 R2 standard server. HV01 is a Hyper-V host server, but HV01 could be replaced by PC0001 as long as PC0001 has enough memory and is capable of running Hyper-V. MDT01, HV01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation.
|
||||
|
||||
>{!NOTE]}
|
||||
>!NOTE]
|
||||
>For important details about the setup for the steps outlined in this article, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof).
|
||||
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: jaimeo
|
||||
ms.author: jaimeo
|
||||
ms.date: 03/20/2018
|
||||
ms.date: 04/03/2018
|
||||
---
|
||||
|
||||
# Frequently asked questions and troubleshooting Windows Analytics
|
||||
@ -33,6 +33,8 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win
|
||||
|
||||
[Disable Upgrade Readiness](#disable-upgrade-readiness)
|
||||
|
||||
[Exporting large data sets](#exporting-large-data-sets)
|
||||
|
||||
|
||||
### Devices not showing up
|
||||
|
||||
@ -55,6 +57,11 @@ If you want to check a large number of devices, you should run the latest script
|
||||
|
||||
If you think the issue might be related to a network proxy, check "Enable data sharing" section of the [Enrolling devices in Windows Analytics](windows-analytics-get-started.md) topic. Also see [Understanding connectivity scenarios and the deployment script](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog.
|
||||
|
||||
If you have deployed images that have not been generalized, then many of them might have the same ID and so analytics will see them as one device. If you suspect this is the issue, then you can reset the IDs on the non-generalized devices by performing these steps:
|
||||
1. Net stop diagtrack
|
||||
2. Reg delete hklm\software\microsoft\sqmclient /v MachineId /f
|
||||
3. Net start diagtrack
|
||||
|
||||
|
||||
### Device Health crash data not appearing
|
||||
|
||||
@ -174,6 +181,24 @@ If you want to stop using Upgrade Readiness and stop sending diagnostic data dat
|
||||
3. If you enabled **Internet Explorer Site Discovery**, you can disable Internet Explorer data collection by setting the *IEDataOptIn* registry key to value "0". The IEDataOptIn key can be found under: *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*.
|
||||
4. **Optional step:** You can also remove the “CommercialId” key from: "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection".
|
||||
|
||||
### Exporting large data sets
|
||||
|
||||
Azure Log Analytics is optimized for advanced analytics of large data sets and can efficiently generate summaries and analytics for them. The query language is not optimized (or intended) for returning large raw data sets and has built-in limits to protect against overuse. There are times when it might be necessary to get more data than this, but that should be done sparingly since this is not the intended way to use Azure Log Analytics. The following code snippet shows how to retrieve data from UAApp one “page” at a time:
|
||||
|
||||
```
|
||||
let snapshot = toscalar(UAApp | summarize max(TimeGenerated));
|
||||
let pageSize = 100000;
|
||||
let pageNumber = 0;
|
||||
|
||||
UAApp
|
||||
| where TimeGenerated == snapshot and IsRollup==true and RollupLevel=="Granular" and Importance == "Low install count"
|
||||
| order by AppName, AppVendor, AppVersion desc
|
||||
| serialize
|
||||
| where row_number(0) >= (pageSize * pageNumber)
|
||||
| take pageSize
|
||||
```
|
||||
|
||||
|
||||
|
||||
## Other common questions
|
||||
|
||||
|
||||
@ -53,7 +53,8 @@ To enable data sharing, configure your proxy sever to whitelist the following en
|
||||
| `https://oca.telemetry.microsoft.com` | Online Crash Analysis; required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. |
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>If you have SSL Inspection enabled on your proxy server, you might need to add the above URLs to your SSL inspection exclusion list to allow data to reach Microsoft endpoints.
|
||||
|
||||
### Configuring endpoint access with proxy servers
|
||||
If your organization uses proxy server authentication for outbound traffic, use one or more of the following approaches to ensure that the diagnostic data is not blocked by proxy authentication:
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.date: 03/30/2018
|
||||
ms.date: 04/03/2018
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ To run the Upgrade Readiness deployment script:
|
||||
>
|
||||
> *IEOptInLevel = 3 Data collection is enabled for all sites*
|
||||
|
||||
4. The latest version (03.02.17) of the deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**.
|
||||
4. A recent version (03.02.17) of the deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**.
|
||||
|
||||
The data that is sent is the same data that is collected in the text log file that captures the events and error codes while running the script. This file is named in the following format: **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**.
|
||||
|
||||
@ -75,7 +75,9 @@ To run the Upgrade Readiness deployment script:
|
||||
\*vortex\*.data.microsoft.com<BR>
|
||||
\*settings\*.data.microsoft.com
|
||||
|
||||
5. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system.
|
||||
5. The latest version (03.28.2018) of the deployment script configures insider builds to continue to send the device name to the diagnostic data management service and the analytics portal. If you do not want to have insider builds send the device name sent to analytics and be available in the analytics portal, set **DeviceNAmeOptIn = false**. By default it is true, which preserves the behavior on previous versions of Windows. This setting only applies to insider builds. Note that the device name is also sent to AppInsights, so to ensure the device name is not sent to either place you would need to also set **AppInsightsOptIn = false**.
|
||||
|
||||
6. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system.
|
||||
|
||||
## Exit codes
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: high
|
||||
ms.sitesec: library
|
||||
ms.date: 03/16/2018
|
||||
ms.date: 04/03/2018
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
@ -23,7 +23,7 @@ The following table summarizes various Windows 10 deployment scenarios. The scen
|
||||
- Dynamic deployment methods enable you to configure applications and settings for specific use cases.
|
||||
- Traditional deployment methods use tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager.<br>
|
||||
|
||||
<table border="1">
|
||||
<table border="0">
|
||||
<tr><td align="center" style="width:16%; border:1;" bgcolor='#a0e4fa'><b>Category</b></td>
|
||||
<td align="center" style="width:16%; border:1;" bgcolor='#a0e4fa'><b>Scenario</b></td>
|
||||
<td align="center" style="width:16%; border:1;" bgcolor='#a0e4fa'><b>Description</b></td>
|
||||
|
||||
@ -72,7 +72,7 @@ The table shows the minimum requirements for each deployment.
|
||||
## Frequently Asked Questions
|
||||
|
||||
### Can I deploy Windows Hello for Business using System Center Configuration Manager?
|
||||
Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deploymnet model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager wil no long be supported after November 2018.
|
||||
Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no long be supported after November 2018.
|
||||
|
||||
### What is the password-less strategy?
|
||||
|
||||
|
||||
@ -284,7 +284,7 @@ If box **2a** reads **GP** and box **2b** reads **modern management**, write **A
|
||||
| Web Server | NDES |
|
||||
| CEP Encryption | NDES |
|
||||
|
||||
If box **2a** reads **GP** and box **2b** reads **N/A**, write **AD FA RA** in box **5b** and write the following certificate template names and issuances in box **5c** on your planning worksheet.
|
||||
If box **2a** reads **GP** and box **2b** reads **N/A**, write **AD FS RA** in box **5b** and write the following certificate template names and issuances in box **5c** on your planning worksheet.
|
||||
|
||||
| Certificate Template Name | Issued To |
|
||||
| --- | --- |
|
||||
|
||||
@ -62,7 +62,7 @@ WIP provides:
|
||||
|
||||
- Additional data protection for existing line-of-business apps without a need to update the apps.
|
||||
|
||||
- Ability to wipe corporate data from devices while leaving personal data alone.
|
||||
- Ability to wipe corporate data from Intune MDM enrolled devices while leaving personal data alone.
|
||||
|
||||
- Use of audit reports for tracking issues and remedial actions.
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: brianlic-msft
|
||||
ms.date: 09/21/2017
|
||||
ms.date: 04/02/2018
|
||||
---
|
||||
|
||||
# Configure the Application Identity service
|
||||
@ -38,4 +38,12 @@ Membership in the local **Administrators** group, or equivalent, is the minimum
|
||||
2. Click the **Services** tab, right-click **AppIDSvc**, and then click **Start Service**.
|
||||
3. Verify that the status for the Application Identity service is **Running**.
|
||||
|
||||
Starting with Windows 10, the Application Identity service is now a protected process. Because of this, you can no longer manually set the service **Startup type** to **Automatic**.
|
||||
Starting with Windows 10, the Application Identity service is now a protected process. Because of this, you can no longer manually set the service **Startup type** to **Automatic** by using the Sevices snap-in. Try either of these methods instead:
|
||||
|
||||
- Open an elevated commnad prompt or PowerShell session and type:
|
||||
|
||||
```powershell
|
||||
sc.exe config appidsvc start= auto
|
||||
```
|
||||
|
||||
- Create a security template that configures appidsvc to be automatic start, and apply it using secedit.exe or LGPO.exe.
|
||||
|
||||
@ -152,7 +152,7 @@ After the catalog file is signed, add the signing certificate to a WDAC policy,
|
||||
|
||||
> **Note** Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity.
|
||||
|
||||
3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `<policypath>` and `<certpath>`:
|
||||
3. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule?view=win10-ps) to add the signing certificate to the WDAC policy, filling in the correct path and filenames for `<policypath>` and `<certpath>`:
|
||||
|
||||
` Add-SignerRule -FilePath <policypath> -CertificatePath <certpath> -User `
|
||||
|
||||
|
||||
@ -110,7 +110,7 @@ For example:
|
||||
### Enable the managed installer option in WDAC policy
|
||||
|
||||
In order to enable trust for the binaries laid down by managed installers, the Allow: Managed Installer option must be specified in your WDAC policy.
|
||||
This can be done by using the [Set-RuleOption cmdlet](https://technet.microsoft.com/itpro/powershell/windows/configci/set-ruleoption).
|
||||
This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps).
|
||||
An example of the managed installer option being set in policy is shown below.
|
||||
|
||||
```code
|
||||
|
||||
@ -42,7 +42,7 @@ If you plan to use an internal CA to sign catalog files or WDAC policies, see th
|
||||
|
||||
WDAC policies include *policy rules*, which control options such as audit mode or whether UMCI is enabled in a WDAC policy. You can modify these options in a new or existing WDAC policy. (For information about *file rules*, which specify the level at which applications will be identified and trusted, see the next section, [Windows Defender Application Control file rule levels](#windows-defender-application-control-file-rule-levels).)
|
||||
|
||||
To modify the policy rule options of an existing WDAC policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
|
||||
To modify the policy rule options of an existing WDAC policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps). Note the following examples of how to use this cmdlet to add and remove a rule option on an existing WDAC policy:
|
||||
|
||||
- To ensure that UMCI is enabled for a WDAC policy that was created with the `-UserPEs` (user mode) option, add rule option 0 to an existing policy by running the following command:
|
||||
|
||||
|
||||
@ -20,25 +20,6 @@ With thousands of new malicious files created every day, using traditional metho
|
||||
|
||||
Windows Defender Device Guard also uses virtualization-based security to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. Even if an attacker manages to get control of the Windows kernel itself, the ability to run malicious executable code is much less likely.
|
||||
|
||||
This guide explores the individual features in Windows Defender Device Guard as well as how to plan for, configure, and deploy them. It includes:
|
||||
|
||||
- [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
|
||||
|
||||
- [Requirements and deployment planning guidelines for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md)
|
||||
|
||||
- [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md)
|
||||
|
||||
- [Deploy Windows Defender Application Control](deploy-windows-defender-application-control.md)
|
||||
|
||||
- [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md)
|
||||
|
||||
- [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md)
|
||||
|
||||
- [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
|
||||
|
||||
- [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md)
|
||||
|
||||
- [Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md)
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -811,7 +811,7 @@ To create a WDAC policy, copy each of the following commands into an elevated Wi
|
||||
|
||||
> - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**.
|
||||
|
||||
3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the WDAC policy to a binary format:
|
||||
3. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) to convert the WDAC policy to a binary format:
|
||||
|
||||
` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
|
||||
|
||||
@ -955,11 +955,11 @@ To merge two WDAC policies, complete the following steps in an elevated Windows
|
||||
> [!Note]
|
||||
> The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit WDAC policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other WDAC policies, update the variables accordingly.
|
||||
|
||||
2. Use [Merge-CIPolicy](https://technet.microsoft.com/library/mt634485.aspx) to merge two policies and create a new WDAC policy:
|
||||
2. Use [Merge-CIPolicy](https://docs.microsoft.com/powershell/module/configci/merge-cipolicy?view=win10-ps) to merge two policies and create a new WDAC policy:
|
||||
|
||||
` Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy`
|
||||
|
||||
3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the merged WDAC policy to binary format:
|
||||
3. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) to convert the merged WDAC policy to binary format:
|
||||
|
||||
` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin `
|
||||
|
||||
@ -987,7 +987,7 @@ Every WDAC policy is created with audit mode enabled. After you have successfull
|
||||
|
||||
2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the WDAC policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options.
|
||||
|
||||
To ensure that these options are enabled in a policy, use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) as shown in the following commands. You can run these commands even if you're not sure whether options 9 and 10 are already enabled—if so, the commands have no effect.
|
||||
To ensure that these options are enabled in a policy, use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps) as shown in the following commands. You can run these commands even if you're not sure whether options 9 and 10 are already enabled—if so, the commands have no effect.
|
||||
|
||||
` Set-RuleOption -FilePath $InitialCIPolicy -Option 9`
|
||||
|
||||
@ -997,14 +997,14 @@ Every WDAC policy is created with audit mode enabled. After you have successfull
|
||||
|
||||
` copy $InitialCIPolicy $EnforcedCIPolicy`
|
||||
|
||||
4. Use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) to delete the audit mode rule option:
|
||||
4. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps) to delete the audit mode rule option:
|
||||
|
||||
` Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete`
|
||||
|
||||
> [!Note]
|
||||
> To enforce a WDAC policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a WDAC policy.
|
||||
|
||||
5. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the new WDAC policy to binary format:
|
||||
5. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) to convert the new WDAC policy to binary format:
|
||||
|
||||
` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin`
|
||||
|
||||
@ -1052,7 +1052,7 @@ If you do not have a code signing certificate, see the [Optional: Create a code
|
||||
|
||||
` cd $env:USERPROFILE\Desktop `
|
||||
|
||||
5. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add an update signer certificate to the WDAC policy:
|
||||
5. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule?view=win10-ps) to add an update signer certificate to the WDAC policy:
|
||||
|
||||
` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath <Path to exported .cer certificate> -Kernel -User –Update`
|
||||
|
||||
@ -1060,11 +1060,11 @@ If you do not have a code signing certificate, see the [Optional: Create a code
|
||||
> *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3.
|
||||
Also, adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed WDAC policies, see the [Disable signed Windows Defender Application Control policies within Windows](#disable-signed-windows-defender-application-control-policies-within-windows) section.
|
||||
|
||||
6. Use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) to remove the unsigned policy rule option:
|
||||
6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption?view=win10-ps) to remove the unsigned policy rule option:
|
||||
|
||||
` Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete`
|
||||
|
||||
7. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the policy to binary format:
|
||||
7. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) to convert the policy to binary format:
|
||||
|
||||
` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ This policy setting is dependent on the **Account lockout threshold** policy set
|
||||
|
||||
If [Account lockout threshold](account-lockout-threshold.md) is configured, after the specified number of failed attempts, the account will be locked out. If th **Account lockout duration** is set to 0, the account will remain locked until an administrator unlocks it manually.
|
||||
|
||||
It is advisable to set **Account lockout duration** to approximately 15 minutes. To specify that the account will never be locked out, set the Account lockout threshold value to 0.
|
||||
It is advisable to set **Account lockout duration** to approximately 15 minutes. To specify that the account will never be locked out, set the **Account lockout threshold** value to 0.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -9,9 +9,9 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: iaanw
|
||||
ms.author: iawilt
|
||||
ms.date: 11/20/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/04/2018
|
||||
---
|
||||
|
||||
# Configure and validate network connections for Windows Defender Antivirus
|
||||
@ -77,7 +77,7 @@ Microsoft Update Service (MU)
|
||||
Signature and product updates
|
||||
</td>
|
||||
<td>
|
||||
*.updates.microsoft.com
|
||||
*.update.microsoft.com
|
||||
</td>
|
||||
</tr>
|
||||
<tr style="vertical-align:top">
|
||||
|
||||
@ -9,9 +9,9 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: iaanw
|
||||
ms.author: iawilt
|
||||
ms.date: 11/09/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/04/2018
|
||||
---
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ This table indicates the functionality and features that are available in each s
|
||||
|
||||
State | Description | [Real-time protection](configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](enable-cloud-protection-windows-defender-antivirus.md) | [Limited periodic scanning availability](limited-periodic-scanning-windows-defender-antivirus.md) | [File scanning and detection information](customize-run-review-remediate-scans-windows-defender-antivirus.md) | [Threat remediation](configure-remediation-windows-defender-antivirus.md) | [Threat definition updates](manage-updates-baselines-windows-defender-antivirus.md)
|
||||
:-|:-|:-:|:-:|:-:|:-:|:-:
|
||||
Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
|
||||
Passive mode | Windows Defender AV will not be used as the antivirus app, and threats will not be remediated by Windows Defender AV. Files will be scanned and reports will be provided for threat detections which are shared with the Windows Defender ATP service. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
|
||||
Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]]
|
||||
Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
|
||||
|
||||
|
||||
@ -9,7 +9,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
ms.date: 11/30/2017
|
||||
ms.date: 04/04/2018
|
||||
---
|
||||
|
||||
# Configure Windows Defender ATP server endpoints
|
||||
@ -80,13 +80,52 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
| winatp-gw-weu.microsoft.com | 443 |
|
||||
|
||||
|
||||
### Offboard server endpoints
|
||||
## Offboard server endpoints
|
||||
You have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Windows Defender ATP workspace configuration
|
||||
|
||||
|
||||
### Uninstall servers by uinstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
|
||||
### Remove the Windows Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
2. Select the Windows Defender ATP workspace, and click **Remove**.
|
||||
|
||||
|
||||
|
||||
#### Run a PowerShell command to remove the configuration
|
||||
|
||||
1. Get your workspace ID by going to **Endpoint management** > **Servers**:
|
||||
|
||||
|
||||
|
||||
2. Open an elevated PowerShell and run the following command. Use the workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
```
|
||||
# Load agent scripting object
|
||||
$AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg
|
||||
# Remove OMS Workspace
|
||||
$AgentCfg.RemoveCloudWorkspace($WorkspaceID)
|
||||
# Reload the configuration and apply changes
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
```
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 127 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Loading…
x
Reference in New Issue
Block a user