From 4cac115392ab4615a65e85638331d198ff23d265 Mon Sep 17 00:00:00 2001 From: Andrea Barr <81656118+AndreaLBarr@users.noreply.github.com> Date: Thu, 17 Jun 2021 16:36:54 -0700 Subject: [PATCH 1/7] Adding Question and Answer Added a question and answer as requested from Radia Soulmani . --- .../faq-md-app-guard.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml index 03baa2d537..98fc46090b 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -70,6 +70,11 @@ sections: answer: | Make sure to enable the extensions policy on your Application Guard configuration. + - question: | + I’m trying to watch playback video with HDR, why is the HDR option missing? + answer: | + In order for HDR video playback to work in the container, vGPU Hardware Acceleration needs to be enabled in Application Guard. + - question: | How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? answer: | From 4214f6193ad6590941d482a82942d27493561997 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Fri, 25 Jun 2021 12:56:06 -0700 Subject: [PATCH 2/7] update driver topic --- ...icrosoft-recommended-driver-block-rules.md | 161 +++++++++++++++++- 1 file changed, 154 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 887fc765be..44f0200b2e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -1,9 +1,9 @@ --- title: Microsoft recommended driver block rules (Windows 10) -description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. -keywords: security, malware, kernel mode, driver +description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. +keywords: security, malware, kernel mode, driver ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: m365-security +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,8 +14,7 @@ author: jgeurten ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 10/15/2020 -ms.technology: mde +ms.date: --- # Microsoft recommended driver block rules @@ -30,7 +29,7 @@ Microsoft has strict requirements for code running in kernel. Consequently, mali - Hypervisor-protected code integrity (HVCI) enabled devices - Windows 10 in S mode (S mode) devices -Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based-protection-of-code-integrity.md) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. +Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. > [!Note] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. It is recommended that this policy be first validated in audit mode before rolling the rules into enforcement mode. @@ -127,6 +126,80 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -352,6 +425,80 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -385,4 +532,4 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based ## More information -- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) \ No newline at end of file +- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) From 8c7a9c164c557f35bc0bb73f1d9e25a87d3d8966 Mon Sep 17 00:00:00 2001 From: Nazmus Sakib Date: Fri, 25 Jun 2021 13:23:51 -0700 Subject: [PATCH 3/7] Add TPM2.0 recommendation Update additional details on TPM2.0 usage/recommendation in feature table --- .../tpm/tpm-recommendations.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 6179ba0c0a..6bde2d3d8d 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -111,21 +111,20 @@ The following table defines which Windows features require TPM support. Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-|-|-|- - Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot + Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Automatic Device Encryption requires Modern Standby](../bitlocker/bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) including TPM 2.0 support Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. Windows Defender Application Control (Device Guard) | No | Yes | Yes - Windows Defender System Guard | Yes | No | Yes - Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. - Device Health Attestation| Yes | Yes | Yes - Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. + Windows Defender System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with Windows Defender System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. + Device Health Attestation| Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. + Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator will take advantage of TPM 2.0 for key storage. UEFI Secure Boot | No | Yes | Yes TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes Virtual Smart Card | Yes | Yes | Yes Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. - DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts @@ -133,4 +132,4 @@ Government customers and enterprise customers in regulated industries may have a ## Related topics -- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) \ No newline at end of file +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) From 46f1dd1f676094fb8b63692ebfe2ecd4cb04e8a7 Mon Sep 17 00:00:00 2001 From: David Strome Date: Fri, 25 Jun 2021 13:34:41 -0700 Subject: [PATCH 4/7] Remove SV docset --- .openpublishing.publish.config.json | 14 -------- windows/sv/TOC.yml | 5 --- windows/sv/breadcrumb/toc.yml | 3 -- windows/sv/docfx.json | 51 ----------------------------- windows/sv/index.md | 11 ------- 5 files changed, 84 deletions(-) delete mode 100644 windows/sv/TOC.yml delete mode 100644 windows/sv/breadcrumb/toc.yml delete mode 100644 windows/sv/docfx.json delete mode 100644 windows/sv/index.md diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 32eb1b181b..f9ebdac192 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -129,20 +129,6 @@ "build_entry_point": "docs", "template_folder": "_themes" }, - { - "docset_name": "sv", - "build_source_folder": "windows/sv", - "build_output_subfolder": "sv", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, { "docset_name": "win-access-protection", "build_source_folder": "windows/access-protection", diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml deleted file mode 100644 index 01da3e1c0a..0000000000 --- a/windows/sv/TOC.yml +++ /dev/null @@ -1,5 +0,0 @@ -- name: Index - href: index.md - - - diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml deleted file mode 100644 index 48236190f9..0000000000 --- a/windows/sv/breadcrumb/toc.yml +++ /dev/null @@ -1,3 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json deleted file mode 100644 index e7955464fe..0000000000 --- a/windows/sv/docfx.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**", - "README.md", - "LICENSE", - "LICENSE-CODE", - "ThirdPartyNotices.md" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": { - "breadcrumb_path": "/windows/windows-11/breadcrumb/toc.json", - "extendBreadcrumb": true, - "feedback_system": "None" - }, - "fileMetadata": {}, - "template": [], - "dest": "windows-11", - "markdownEngineName": "markdig" - } -} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md deleted file mode 100644 index 7a31c42d39..0000000000 --- a/windows/sv/index.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: SV -description: SV -ms.prod: w10 -manager: laurawi -ms.topic: article -author: greg-lindsay -ms.author: greglin ---- - -# . \ No newline at end of file From faeaeaddf09933dc0263f9b89e76065217129b2c Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Fri, 25 Jun 2021 14:17:28 -0700 Subject: [PATCH 5/7] Removed duplicate block events and file IOCs not intended to be blocked --- ...icrosoft-recommended-driver-block-rules.md | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 7d56cdbe9e..835c6da8f0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -126,6 +126,40 @@ Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -351,6 +385,40 @@ Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 8d5d5e2f5ad1cf5ec2d42c19692250213fa9a3cd Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 25 Jun 2021 16:20:23 -0700 Subject: [PATCH 6/7] Acrolinx "a existing" --- .../security/information-protection/tpm/tpm-recommendations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 6bde2d3d8d..2a29a3881a 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -95,7 +95,7 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is u ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of an existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). ### IoT Core From c163663490a9c6b53e407a7ea2145407739cac0d Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 25 Jun 2021 16:20:54 -0700 Subject: [PATCH 7/7] Fixed broken note --- .../security/information-protection/tpm/tpm-recommendations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 2a29a3881a..658a7d98d5 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -72,7 +72,7 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. - +> > Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. ## Discrete, Integrated or Firmware TPM?