From 2a15c969728d8b5598d69f2e722edd52ca44b745 Mon Sep 17 00:00:00 2001 From: John Tobin Date: Wed, 16 Aug 2017 11:44:53 -0700 Subject: [PATCH 1/3] Edit TPM topic for formatting and text. --- ...orm-module-services-group-policy-settings.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md index 8203714148..4ab3894c38 100644 --- a/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md @@ -1,6 +1,6 @@ --- title: TPM Group Policy settings (Windows 10) -description: This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. +description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd ms.prod: w10 ms.mktglfcycl: deploy @@ -15,20 +15,25 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -This topic for the IT professional describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. +This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. -The TPM Services Group Policy settings are located at: +The Group Policy settings for TPM services are located at: **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** -### Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0 +## Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0 -Introduced in Windows 10, version 1703, this policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. Setting this policy will take effect only if: a) the TPM was originally prepared using a version of Windows after Windows 10 Version 1607, and b) the System has a TPM 2.0. +Introduced in Windows 10, version 1703, this policy setting configures the TPM to use the Dictionary Attack Prevention Parameters (lockout threshold and recovery time) to the values that were used for Windows 10 Version 1607 and below. + +> [!IMPORTANT] +> Setting this policy will take effect only if: +- The TPM was originally prepared using a version of Windows after Windows 10 Version 1607 +- The system has a TPM 2.0. Note that enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only way for the disabled setting of this policy to take effect on a system where it was once enabled is to: a) disable it from group policy and b) clear the TPM on the system. -**The following Group Policy settings were introduced in Window 10:** +The following Group Policy settings were introduced in Window 10: ### Configure the list of blocked TPM commands From 5b6cf8c46af456840eeb295c52de7343886c6d60 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 16 Aug 2017 18:48:18 +0000 Subject: [PATCH 2/3] Merged PR 2740: ExploitGuard policy - new in Policy CSP --- windows/client-management/mdm/TOC.md | 1 + ...ew-in-windows-mdm-enrollment-management.md | 2 + .../policy-configuration-service-provider.md | 8 +++ .../mdm/policy-csp-exploitguard.md | 58 +++++++++++++++++++ 4 files changed, 69 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-exploitguard.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 406f309f85..2d6046fef1 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -200,6 +200,7 @@ #### [ErrorReporting](policy-csp-errorreporting.md) #### [EventLogService](policy-csp-eventlogservice.md) #### [Experience](policy-csp-experience.md) +#### [ExploitGuard](policy-csp-exploitguard.md) #### [Games](policy-csp-games.md) #### [InternetExplorer](policy-csp-internetexplorer.md) #### [Kerberos](policy-csp-kerberos.md) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index b84fdaa3fa..c2218a1fab 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -982,6 +982,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • DeviceGuard/EnableVirtualizationBasedSecurity
  • DeviceGuard/RequirePlatformSecurityFeatures
  • DeviceGuard/LsaCfgFlags
    • +
  • ExploitGuard/ExploitProtectionSettings
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
  • LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
  • LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus
    • @@ -1372,6 +1373,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies for Windows 10, version 1709: