mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 18:33:43 +00:00
Merge branch 'master' into App-v-revision
This commit is contained in:
Heidi Lohr
@ -2,6 +2,7 @@
|
||||
title: Device update management
|
||||
description: In the current device landscape of PC, tablets, phones, and IoT devices, the Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology.
|
||||
ms.assetid: C27BAEE7-2890-4FB7-9549-A6EACC790777
|
||||
keywords: mdm,management,administrator
|
||||
ms.author: maricia
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
@ -13,15 +14,18 @@ ms.date: 11/15/2017
|
||||
|
||||
# Device update management
|
||||
|
||||
In the current device landscape of PC, tablets, phones, and IoT devices, the Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows 10, we are investing heavily in extending the management capabilities available to MDMs. One key feature we are adding is the ability for MDMs to keep devices up-to-date with the latest Microsoft Updates.
|
||||
>[!TIP]
|
||||
>If you're not a developer or administrator, you'll find more helpful information in the [Windows Update: Frequently Asked Questions](https://support.microsoft.com/help/12373/windows-update-faq).
|
||||
|
||||
In particular, Windows 10 provides additional APIs to enable MDMs to:
|
||||
In the current device landscape of PC, tablets, phones, and IoT devices, Mobile Device Management (MDM) solutions are becoming prevalent as a lightweight device management technology. In Windows 10, we are investing heavily in extending the management capabilities available to MDMs. One key feature we are adding is the ability for MDMs to keep devices up-to-date with the latest Microsoft updates.
|
||||
|
||||
In particular, Windows 10 provides APIs to enable MDMs to:
|
||||
|
||||
- Ensure machines stay up-to-date by configuring Automatic Update policies.
|
||||
- Test updates on a smaller set of machines before enterprise-wide rollout by configuring which updates are approved for a given device.
|
||||
- Get compliance status of managed devices so IT can easily understand which machines still need a particular security patch, or how up-to-date is a particular machine.
|
||||
|
||||
This topic provides MDM ISVs with the information they need to implement update management in Windows 10.
|
||||
This topic provides MDM independent software vendors (ISV) with the information they need to implement update management in Windows 10.
|
||||
|
||||
In Windows 10, the MDM protocol has been extended to better enable IT admins to manage updates. In particular, Windows has added configuration service providers (CSPs) that expose policies and actions for MDMs to:
|
||||
|
||||
@ -30,7 +34,8 @@ In Windows 10, the MDM protocol has been extended to better enable IT admins to
|
||||
- Specify a per-device update approval list, to ensure devices don’t install unapproved updates that have not been tested.
|
||||
- Approve EULAs on behalf of the end-user so update deployment can be automated even for updates with EULAs.
|
||||
|
||||
The OMA DM APIs for specifying update approvals and getting compliance status reference updates using an Update ID, which is a GUID that identifies a particular update. The MDM, of course, will want to expose IT-friendly information about the update (instead of a raw GUID), including the update’s title, description, KB, update type (for example, a security update or service pack). For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526707).
|
||||
The OMA DM APIs for specifying update approvals and getting compliance status refer to updates by using an Update ID, which is a GUID that identifies a particular update. The MDM, of course, will want to expose IT-friendly information about the update (instead of a raw GUID), including the update’s title, description, KB, update type (for example, a security update or service pack). For more information, see [\[MS-WSUSSS\]: Windows Update Services: Server-Server Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526707).
|
||||
|
||||
For more information about the CSPs, see [Update CSP](update-csp.md) and the update policy area of the [Policy CSP](policy-configuration-service-provider.md).
|
||||
|
||||
The following diagram provides a conceptual overview of how this works:
|
||||
|
||||
@ -5,12 +5,12 @@ MS-HAID:
|
||||
- 'p\_phDeviceMgmt.provisioning\_and\_device\_management'
|
||||
- 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm'
|
||||
ms.assetid: 50ac90a7-713e-4487-9cb9-b6d6fdaa4e5b
|
||||
ms.author: maricia
|
||||
ms.author: jdecker
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: MariciaAlforque
|
||||
ms.date: 06/26/2017
|
||||
author: jdeckerms
|
||||
ms.date: 09/12/2018
|
||||
---
|
||||
|
||||
# Mobile device management
|
||||
@ -25,6 +25,12 @@ There are two parts to the Windows 10 management component:
|
||||
|
||||
Third-party MDM servers can manage Windows 10 by using the MDM protocol. The built-in management client is able to communicate with a third-party server proxy that supports the protocols outlined in this document to perform enterprise management tasks. The third-party server will have the same consistent first-party user experience for enrollment, which also provides simplicity for Windows 10 users. MDM servers do not need to create or download a client to manage Windows 10. For details about the MDM protocols, see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( http://go.microsoft.com/fwlink/p/?LinkId=619347).
|
||||
|
||||
<span id="mmat" />
|
||||
## Learn about migrating to MDM
|
||||
|
||||
When an organization wants to move to MDM to manage devices, they should prepare by analyzing their current Group Policy settings to see what they need to transition to MDM management. Microsoft created the [MDM Migration Analysis Tool](https://aka.ms/mmat/) (MMAT) to help. MMAT determines which Group Policies have been set for a target user or computer and then generates a report that lists the level of support for each policy settings in MDM equivalents. For more information, see [MMAT Instructions](https://github.com/WindowsDeviceManagement/MMAT/blob/master/MDM%20Migration%20Analysis%20Tool%20Instructions.pdf).
|
||||
|
||||
|
||||
## Learn about device enrollment
|
||||
|
||||
|
||||
|
||||
@ -1760,6 +1760,12 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
|
||||
## Change history in MDM documentation
|
||||
|
||||
### September 2018
|
||||
|
||||
New or updated topic | Description
|
||||
--- | ---
|
||||
[Mobile device management](index.md#mmat) | Added information about the MDM Migration Analysis Tool (MMAT).
|
||||
|
||||
### August 2018
|
||||
|
||||
<table class="mx-tdBreakAll">
|
||||
|
||||
@ -53,7 +53,7 @@ In Windows 10, version 1803, you can install the **Kiosk Browser** app from Micr
|
||||
|
||||
1. [Get **Kiosk Browser** in Microsoft Store for Business with offline license type.](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps)
|
||||
2. [Deploy **Kiosk Browser** to kiosk devices.](https://docs.microsoft.com/microsoft-store/distribute-offline-apps)
|
||||
3. Configure policies using settings from the Policy Configuration Service Provider (CSP) for [KioskBrowser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-kioskbrowser). These settings can be configured using your MDM service provider, or [in a provisioning package](provisioning-packages/provisioning-create-package.md).
|
||||
3. Configure policies using settings from the Policy Configuration Service Provider (CSP) for [KioskBrowser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-kioskbrowser). These settings can be configured using your MDM service provider, or [in a provisioning package](provisioning-packages/provisioning-create-package.md). In Windows Configuration Designer, the settings are located in **Policies > KioskBrowser** when you select advanced provisioning for Windows desktop editions.
|
||||
|
||||
>[!NOTE]
|
||||
>If you configure the kiosk using a provisioning package, you must apply the provisioning package after the device completes the out-of-box experience (OOBE).
|
||||
|
||||
@ -7,7 +7,7 @@ ms.localizationpriority: medium
|
||||
ms.prod: w10
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
ms.date: 09/19/2017
|
||||
ms.date: 09/12/2018
|
||||
author: greg-lindsay
|
||||
---
|
||||
|
||||
@ -25,6 +25,12 @@ This topic provides an overview of new solutions and online content related to d
|
||||
- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history).
|
||||
|
||||
|
||||
## Windows 10 servicing and support
|
||||
|
||||
Microsoft is [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. This includes all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Office 365 ProPlus will continue to be supported for 18 months (there is no change for these editions). These support policies are summarized in the table below.
|
||||
|
||||
|
||||
|
||||
## Windows 10 Enterprise upgrade
|
||||
|
||||
Windows 10 version 1703 includes a Windows 10 Enterprise E3 and E5 benefit to Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA). These customers can now subscribe users to Windows 10 Enterprise E3 or E5 and activate their subscriptions on up to five devices. Virtual machines can also be activated. For more information, see [Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md).
|
||||
|
||||
BIN
windows/deployment/images/support-cycle.png
Normal file
BIN
windows/deployment/images/support-cycle.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 8.7 KiB |
@ -1,11 +1,11 @@
|
||||
---
|
||||
title: Get started with Device Health
|
||||
description: Configure Device Health in OMS to see statistics on frequency and causes of crashes of devices in your network.
|
||||
keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers
|
||||
description: Configure Device Health in Azure Log Analytics to monitor health (such as crashes and sign-in failures) for your Windows 10 devices.
|
||||
keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers, azure
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.date: 08/21/2018
|
||||
ms.date: 09/11/2018
|
||||
ms.pagetype: deploy
|
||||
author: jaimeo
|
||||
ms.author: jaimeo
|
||||
@ -14,74 +14,59 @@ ms.localizationpriority: medium
|
||||
|
||||
# Get started with Device Health
|
||||
|
||||
>[!IMPORTANT]
|
||||
>**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition).
|
||||
This topic explains the steps necessary to configure your environment for Windows Analytics Device Health.
|
||||
|
||||
This topic explains the steps necessary to configure your environment for Windows Analytics: Device Health.
|
||||
|
||||
Steps are provided in sections that follow the recommended setup process:
|
||||
|
||||
1. [Add Device Health](#add-device-health-to-microsoft-operations-management-suite) to Microsoft Operations Management Suite.
|
||||
2. [Enroll devices in Windows Analytics](#deploy-your-commercial-id-to-your-windows-10-devices) to your organization’s devices.
|
||||
3. [Use Device Health to monitor frequency and causes of device crashes](#use-device-health-to-monitor-frequency-and-causes-of-device-crashes) once your devices are enrolled.
|
||||
- [Get started with Device Health](#get-started-with-device-health)
|
||||
- [Add the Device Health solution to your Azure subscription](#add-the-device-health-solution-to-your-azure-subscription)
|
||||
- [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics)
|
||||
- [Use Device Health to monitor device crashes, app crashes, sign-in failures, and more](#use-device-health-to-monitor-device-crashes-app-crashes-sign-in-failures-and-more)
|
||||
- [Related topics](#related-topics)
|
||||
|
||||
|
||||
|
||||
## Add Device Health to Microsoft Operations Management Suite or Azure Log Analytics
|
||||
## Add the Device Health solution to your Azure subscription
|
||||
|
||||
Device Health is offered as a solution in the Microsoft Operations Management Suite (OMS) and Azure Log Analytics, a collection of cloud-based servicing for monitoring and automating your on-premises and cloud environments. For more information about OMS, see [Operations Management Suite overview](https://azure.microsoft.com/en-us/documentation/articles/operations-management-suite-overview/) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/).
|
||||
Device Health is offered as a *solution* which you link to a new or existing [Azure Log Analytics](https://azure.microsoft.com/services/log-analytics/) *workspace* within your Azure *subscription*. To configure this, follows these steps:
|
||||
|
||||
**If you are already using Windows Analytics**, you should use the same Azure Log Analytics workspace you're already using. Find Device Health in the Solutions Gallery. Select the **Device Health** tile in the gallery and then click **Add** on the solution's details page. Device Health is now visible in your workspace. While you're in the Solutions Gallery, you should consider installing the [Upgrade Readiness](../upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md) and [Update Compliance](update-compliance-monitor.md) solutions as well, if you haven't already.
|
||||
1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal.
|
||||
|
||||
>[!NOTE]
|
||||
> Device Health is included at no additional cost with Windows 10 [education and enterprise licensing](https://docs.microsoft.com/en-us/windows/deployment/update/device-health-monitor#device-health-licensing). An Azure subscription is required for managing and using Device Health, but no Azure charges are expected to accrue to the subscription as a result of using Device Health.
|
||||
|
||||
>[!NOTE]
|
||||
>If you are already using OMS, you can also follow [this link](https://portal.mms.microsoft.com/#Workspace/ipgallery/details/details/index?IPId=DeviceHealthProd) to go directly to the Device Health solution and add it to your workspace.
|
||||
2. In the Azure portal select **Create a resource**, search for "Device Health", and then select **Create** on the **Device Health** solution.
|
||||
|
||||
|
||||
**If you are not yet using Windows Analytics or Azure Log Analytics**, follow these steps to subscribe:
|
||||
|
||||
1. Go to [Operations Management Suite](https://www.microsoft.com/en-us/cloud-platform/operations-management-suite) on Microsoft.com and click **Sign in**.
|
||||
[](images/uc-02.png)
|
||||
|
||||
|
||||
2. Sign in to Operations Management Suite (OMS). You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory (Azure AD), use a Work or School account when you sign in to OMS. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in OMS.
|
||||
[](images/uc-03.png)
|
||||
|
||||
|
||||
3. Create a new OMS workspace.
|
||||
|
||||
[](images/uc-04.png)
|
||||
|
||||
4. Enter a name for the workspace, select the workspace region, and provide the email address that you want associated with this workspace. Click **Create**.
|
||||
|
||||
[](images/uc-05.png)
|
||||
|
||||
5. If your organization already has an Azure subscription, you can link it to your workspace. Note that you may need to request access from your organization’s Azure administrator. If your organization does not have an Azure subscription, create a new one or select the default OMS Azure subscription from the list. If you do not yet have an Azure subscription, follow [this guide](https://blogs.technet.microsoft.com/upgradeanalytics/2016/11/08/linking-operations-management-suite-workspaces-to-microsoft-azure/) to create and link an Azure subscription to an OMS workspace.
|
||||
|
||||
[](images/uc-06.png)
|
||||
|
||||
6. To add Update Readiness to your workspace, go to the Solution Gallery, Select the **Update Readiness** tile and then select **Add** on the solution's detail page.
|
||||
|
||||
[](images/solution-bundle.png)
|
||||
|
||||
7. Click the **Update Readiness** tile to configure the solution. The **Settings Dashboard** opens. In this example, both Upgrade Readiness and Device Health solutions have been added.
|
||||
|
||||
[](images/OMS-after-adding-solution.jpg)
|
||||
|
||||
|
||||
|
||||
After you have added Device Health and devices have a Commercial ID, you will begin receiving data. It will typically take 24-48 hours for the first data to begin appearing. The following section explains how to deploy your Commercial ID to your Windows 10 devices.
|
||||
|
||||
>[!NOTE]
|
||||
>You can unsubscribe from the Device Health solution if you no longer want to monitor your organization’s devices. User device data will continue to be shared with Microsoft while the opt-in keys are set on user devices and the proxy allows traffic.
|
||||
|
||||
3. Choose an existing workspace or create a new workspace to host the Device Health solution.
|
||||
|
||||
- If you are using other Windows Analytics solutions (Upgrade Readiness or Update Compliance) you should add Device Health to the same workspace.
|
||||
- If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started:
|
||||
- Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*.
|
||||
- For the resource group setting select **Create new** and use the same name you chose for your new workspace.
|
||||
- For the location setting, choose the Azure region where you would prefer the data to be stored.
|
||||
- For the pricing tier select **Free**.
|
||||
4. Now that you have selected a workspace, you can go back to the Device Health blade and select **Create**.
|
||||
|
||||
5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.DeviceHealth' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear.
|
||||
|
||||
- Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Device Health solution.
|
||||
- Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour.
|
||||
|
||||
## Enroll devices in Windows Analytics
|
||||
|
||||
Once you've added Update Compliance to Microsoft Operations Management Suite, you can now start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
|
||||
Once you've added Device Health to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Device Health there are two key steps for enrollment:
|
||||
1. Deploy your CommercialID (from Device Health Settings page) to your Windows 10 devices (typically using Group Policy or similar)
|
||||
2. Ensure the Windows Diagnostic Data setting on devices is set to Enhanced or Full (typically using Group Policy or similar). Note that the [Limit Enhanced](https://docs.microsoft.com/en-us/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) policy can substantially reduce the amount of diagnostic data shared with Microsoft while still allowing Device Health to function.
|
||||
For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md).
|
||||
|
||||
After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it may take 48-72 hours for the first data to appear in the solution. Until then, the Device Health tile will show "Performing Assessment."
|
||||
|
||||
## Use Device Health to monitor frequency and causes of device crashes
|
||||
## Use Device Health to monitor device crashes, app crashes, sign-in failures, and more
|
||||
|
||||
Once your devices are enrolled, you can move on to [Using Device Health](device-health-using.md).
|
||||
Once your devices are enrolled and data is flowing, you can move on to [Using Device Health](device-health-using.md).
|
||||
|
||||
>[!NOTE]
|
||||
>You can remove the Device Health solution from your workspace if you no longer want to monitor your organization’s devices. Windows diagnostic data will continue to be shared with Microsoft as normal as per the diagnostic data sharing settings on the devices.
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 85 KiB |
BIN
windows/deployment/update/images/CreateSolution-Part2-Create.png
Normal file
BIN
windows/deployment/update/images/CreateSolution-Part2-Create.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 420 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 451 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 357 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 245 KiB |
@ -1,5 +1,4 @@
|
||||
# [Windows 10 and Windows 10 Mobile](index.md)
|
||||
## [Get started](/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
## [What's new](/windows/whats-new)
|
||||
## [Deployment](/windows/deployment)
|
||||
## [Configuration](/windows/configuration)
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 12 KiB After Width: | Height: | Size: 9.8 KiB |
BIN
windows/privacy/images/ddv-event-feedback.png
Normal file
BIN
windows/privacy/images/ddv-event-feedback.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
BIN
windows/privacy/images/ddv-event-view-basic.png
Normal file
BIN
windows/privacy/images/ddv-event-view-basic.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 134 KiB |
BIN
windows/privacy/images/ddv-event-view-filter.png
Normal file
BIN
windows/privacy/images/ddv-event-view-filter.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 215 KiB |
BIN
windows/privacy/images/ddv-event-view.png
Normal file
BIN
windows/privacy/images/ddv-event-view.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 187 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 17 KiB After Width: | Height: | Size: 9.9 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 10 KiB |
@ -61,9 +61,6 @@
|
||||
### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md)
|
||||
### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md)
|
||||
### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md)
|
||||
### [Manage TPM commands](tpm/manage-tpm-commands.md)
|
||||
### [Manage TPM lockout](tpm/manage-tpm-lockout.md)
|
||||
### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md)
|
||||
### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md)
|
||||
### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md)
|
||||
### [TPM recommendations](tpm/tpm-recommendations.md)
|
||||
|
||||
@ -6,7 +6,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/19/2017
|
||||
---
|
||||
|
||||
|
||||
@ -6,7 +6,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/19/2017
|
||||
---
|
||||
|
||||
|
||||
@ -7,7 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 10/27/2017
|
||||
---
|
||||
|
||||
|
||||
@ -1,24 +1,23 @@
|
||||
---
|
||||
title: View status, clear, or troubleshoot the TPM (Windows 10)
|
||||
title: Troubleshoot the TPM (Windows 10)
|
||||
description: This topic for the IT professional describes how to view status for, clear, or troubleshoot the Trusted Platform Module (TPM).
|
||||
ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 04/19/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 09/11/2018
|
||||
---
|
||||
|
||||
# View status, clear, or troubleshoot the TPM
|
||||
# Troubleshoot the TPM
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
This topic for the IT professional describes actions you can take through the Trusted Platform Module (TPM) snap-in, **TPM.msc**:
|
||||
|
||||
- [View the status of the TPM](#view-the-status-of-the-tpm)
|
||||
This topic provides information for the IT professional to troubleshoot the Trusted Platform Module (TPM):
|
||||
|
||||
- [Troubleshoot TPM initialization](#troubleshoot-tpm-initialization)
|
||||
|
||||
@ -32,15 +31,7 @@ For information about the TPM cmdlets, see [TPM Cmdlets in Windows PowerShell](h
|
||||
|
||||
## About TPM initialization and ownership
|
||||
|
||||
Starting with Windows 10, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password. Therefore, with Windows 10, in most cases, we recommend that you avoid configuring the TPM through **TPM.msc**. The one exception is that in certain circumstances you might use **TPM.msc** to clear the TPM. For more information, see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
|
||||
|
||||
## View the status of the TPM
|
||||
|
||||
To view the status of the TPM, open the TPM Management console (TPM.msc). In the center pane, find the **Status** box.
|
||||
|
||||
In most cases, the status will be **Ready**. If the status is ready but “**with reduced functionality**,” see [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic.
|
||||
|
||||
If the status is **Not ready**, you can try the steps in [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm), later in this topic. If this does not bring it to a **Ready** state, contact the manufacturer, and see the troubleshooting suggestions in the next section.
|
||||
Starting with Windows 10, the operating system automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you would initialize the TPM and create an owner password.
|
||||
|
||||
## Troubleshoot TPM initialization
|
||||
|
||||
@ -72,19 +63,13 @@ For example, toggling TPMs will cause BitLocker to enter recovery mode. We stron
|
||||
|
||||
## Clear all the keys from the TPM
|
||||
|
||||
With Windows 10, in most cases, we recommend that you avoid configuring the TPM through TPM.msc. The one exception is that you can use TPM.msc to clear the TPM, for example, as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, for example, attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly.
|
||||
You can use the Windows Defender Security Center app to clear the TPM as a troubleshooting step, or as a final preparation before a clean installation of a new operating system. Preparing for a clean installation in this way helps ensure that the new operating system can fully deploy any TPM-based functionality that it includes, such as attestation. However, even if the TPM is not cleared before a new operating system is installed, most TPM functionality will probably work correctly.
|
||||
|
||||
Clearing the TPM resets it to an unowned state. After you clear the TPM, the Windows 10 operating system will automatically re-initialize it and take ownership again.
|
||||
|
||||
> [!WARNING]
|
||||
> Clearing the TPM can result in data loss. For more information, see the next section, “Precautions to take before clearing the TPM.”
|
||||
|
||||
There are several ways to clear the TPM:
|
||||
|
||||
- **Clear the TPM as part of a complete reset of the computer**: You might want to remove all files from the computer and completely reset it, for example, in preparation for a clean installation. To do this, we recommend that you use the **Reset** option in **Settings**. When you perform a reset and use the **Remove everything** option, it will clear the TPM as part of the reset. You might be prompted to press a key before the TPM can be cleared. For more information, see the “Reset this PC” section in [Recovery options in Windows 10](https://support.microsoft.com/en-us/help/12415/windows-10-recovery-options).
|
||||
|
||||
- **Clear the TPM to fix “reduced functionality” or “Not ready” TPM status**: If you open TPM.msc and see that the TPM status is something other than **Ready**, you can try using TPM.msc to clear the TPM and fix the status. However, be sure to review the precautions in the next section.
|
||||
|
||||
### Precautions to take before clearing the TPM
|
||||
|
||||
Clearing the TPM can result in data loss. To protect against such loss, review the following precautions:
|
||||
@ -103,15 +88,19 @@ Membership in the local Administrators group, or equivalent, is the minimum requ
|
||||
|
||||
**To clear the TPM**
|
||||
|
||||
1. Open the TPM MMC (tpm.msc).
|
||||
1. Open the Windows Defender Security Center app.
|
||||
|
||||
2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**.
|
||||
2. Click **Device security**.
|
||||
|
||||
3. Under **Actions**, click **Clear TPM**.
|
||||
3. Click **Security processor details**.
|
||||
|
||||
4. You will be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM.
|
||||
4. Click **Security processor troubleshooting**.
|
||||
|
||||
5. After the PC restarts, your TPM will be automatically prepared for use by Windows 10.
|
||||
5. Click **Clear TPM**.
|
||||
|
||||
6. You will be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM.
|
||||
|
||||
7. After the PC restarts, your TPM will be automatically prepared for use by Windows 10.
|
||||
|
||||
## <a href="" id="turn-on-or-turn-off"></a>Turn on or turn off the TPM (available only with TPM 1.2 with Windows 10, version 1507 or 1511)
|
||||
|
||||
@ -149,20 +138,6 @@ If you want to stop using the services that are provided by the TPM, you can use
|
||||
|
||||
- If you did not save your TPM owner password or no longer know it, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password.
|
||||
|
||||
### Change the TPM Owner Password (available only with Windows 10, version 1607 and earlier versions)
|
||||
|
||||
If you have the [owner password](https://technet.microsoft.com/itpro/windows/keep-secure/change-the-tpm-owner-password) available, you can use TPM.msc to change the TPM Owner Password.
|
||||
|
||||
1. Open the TPM MMC (tpm.msc).
|
||||
|
||||
2. In the **Action** pane, click **Change the Owner Password**
|
||||
|
||||
- If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**.
|
||||
|
||||
- If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**.
|
||||
|
||||
This capability was fully removed from TPM.msc in later versions of Windows.
|
||||
|
||||
## Use the TPM cmdlets
|
||||
|
||||
You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/?view=win10-ps).
|
||||
|
||||
@ -20,12 +20,6 @@ This topic for the IT professional describes how to manage which Trusted Platfor
|
||||
|
||||
After a computer user takes ownership of the TPM, the TPM owner can limit which TPM commands can be run by creating a list of blocked TPM commands. The list can be created and applied to all computers in a domain by using Group Policy, or a list can be created for individual computers by using the TPM MMC. Because some hardware vendors might provide additional commands or the Trusted Computing Group may decide to add commands in the future, the TPM MMC also supports the ability to block new commands.
|
||||
|
||||
Domain administrators can configure a list of blocked TPM commands by using Group Policy. Local administrators cannot allow TPM commands that are blocked through Group Policy. For more information about this Group Policy setting, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#configure-the-list-of-blocked-tpm-commands).
|
||||
|
||||
Local administrators can block commands by using the TPM MMC, and commands on the default block list are also blocked unless the Group Policy settings are changed from the default settings.
|
||||
|
||||
Two policy settings control the enforcement which allows TPM commands to run. For more information about these policy settings, see [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#ignore-the-default-list-of-blocked-tpm-commands).
|
||||
|
||||
The following procedures describe how to manage the TPM command lists. You must be a member of the local Administrators group.
|
||||
|
||||
**To block TPM commands by using the Local Group Policy Editor**
|
||||
|
||||
@ -6,7 +6,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/19/2017
|
||||
---
|
||||
|
||||
|
||||
@ -6,7 +6,8 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 08/16/2017
|
||||
---
|
||||
|
||||
|
||||
@ -7,7 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 05/16/2018
|
||||
---
|
||||
|
||||
|
||||
@ -7,7 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
author: andreabichsel
|
||||
ms-author: v-anbic
|
||||
ms.date: 08/21/2018
|
||||
---
|
||||
|
||||
|
||||
@ -6,8 +6,9 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 06/29/2018
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 09/11/2018
|
||||
---
|
||||
|
||||
# TPM Group Policy settings
|
||||
@ -24,37 +25,7 @@ The Group Policy settings for TPM services are located at:
|
||||
|
||||
The following Group Policy settings were introduced in Window 10.
|
||||
|
||||
## Configure the list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to manage the Group Policy list of Trusted Platform Module (TPM) commands that are blocked by Windows.
|
||||
|
||||
If you enable this policy setting, Windows will block the specified commands from being sent to the TPM on the computer. TPM commands are referenced by a command number. For example, command number 129 is **TPM\_OwnerReadInternalPub**, and command number 170 is **TPM\_FieldUpgrade**. To find the command number that is associated with each TPM command, at the command prompt, type **tpm.msc** to open the TPM Management Console and navigate to the **Command Management** section.
|
||||
|
||||
If you disable or do not configure this policy setting, only those TPM commands that are specified through the default or local lists can be blocked by Windows. The default list of blocked TPM commands is preconfigured by Windows.
|
||||
|
||||
- You can view the default list by typing **tpm.msc** at the command prompt, navigating to the **Command Management** section, and exposing the **On Default Block List** column.
|
||||
|
||||
- The local list of blocked TPM commands is configured outside of Group Policy by running the TPM Management Console or scripting using the **Win32\_Tpm** interface.
|
||||
|
||||
## Ignore the default list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to enforce or ignore the computer's default list of blocked Trusted Platform Module (TPM) commands.
|
||||
|
||||
The default list of blocked TPM commands is preconfigured by Windows. You can view the default list by typing **tpm.msc** at the command prompt to open the TPM Management Console, navigating to the **Command Management** section, and exposing the **On Default Block List** column.
|
||||
|
||||
If you enable this policy setting, the Windows operating system will ignore the computer's default list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the local list.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will block the TPM commands in the default list, in addition to the commands that are specified by Group Policy and the local list of blocked TPM commands.
|
||||
|
||||
## Ignore the local list of blocked TPM commands
|
||||
|
||||
This policy setting allows you to enforce or ignore the computer's local list of blocked Trusted Platform Module (TPM) commands.
|
||||
|
||||
The local list of blocked TPM commands is configured outside of Group Policy by typing **tpm.msc** at the command prompt to open the TPM Management Console, or scripting using the **Win32\_Tpm** interface. (The default list of blocked TPM commands is preconfigured by Windows.)
|
||||
|
||||
If you enable this policy setting, the Windows operating system will ignore the computer's local list of blocked TPM commands, and it will block only those TPM commands that are specified by Group Policy or the default list.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will block the TPM commands in the local list, in addition to the commands that are specified in Group Policy and the default list of blocked TPM commands.
|
||||
|
||||
## Configure the level of TPM owner authorization information available to the operating system
|
||||
|
||||
@ -115,7 +86,7 @@ For each standard user, two thresholds apply. Exceeding either threshold prevent
|
||||
|
||||
- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold) This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM.
|
||||
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
|
||||
If you do not configure this policy setting, a default value of 480 minutes (8 hours) is used.
|
||||
|
||||
@ -127,7 +98,7 @@ This setting helps administrators prevent the TPM hardware from entering a locko
|
||||
|
||||
An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored.
|
||||
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
|
||||
If you do not configure this policy setting, a default value of 4 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure.
|
||||
|
||||
@ -139,7 +110,7 @@ This setting helps administrators prevent the TPM hardware from entering a locko
|
||||
|
||||
An authorization failure occurs each time a standard user sends a command to the TPM and receives an error response indicating an authorization failure occurred. Authorization failures older than the duration are ignored.
|
||||
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the TPM Management Console (tpm.msc). Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally.
|
||||
|
||||
If you do not configure this policy setting, a default value of 9 is used. A value of zero means that the operating system will not allow standard users to send commands to the TPM, which might cause an authorization failure.
|
||||
|
||||
|
||||
@ -6,8 +6,9 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
ms.date: 07/27/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 09/11/2018
|
||||
---
|
||||
|
||||
# Trusted Platform Module
|
||||
@ -26,9 +27,6 @@ Trusted Platform Module (TPM) technology is designed to provide hardware-based,
|
||||
| [TPM fundamentals](tpm-fundamentals.md) | Provides background about how a TPM can work with cryptographic keys. Also describes technologies that work with the TPM, such as TPM-based virtual smart cards. |
|
||||
| [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) | Describes TPM services that can be controlled centrally by using Group Policy settings. |
|
||||
| [Back up the TPM recovery information to AD DS](backup-tpm-recovery-information-to-ad-ds.md) | For Windows 10, version 1511 and Windows 10, version 1507 only, describes how to back up a computer’s TPM information to Active Directory Domain Services. |
|
||||
| [Manage TPM commands](manage-tpm-commands.md) | Describes methods by which a local or domain administrator can block or allow specific TPM commands. |
|
||||
| [Manage TPM lockout](manage-tpm-lockout.md) | Describes how TPM lockout works (to help prevent tampering or malicious attacks), and outlines ways to work with TPM lockout settings. |
|
||||
| [Change the TPM owner password](change-the-tpm-owner-password.md) | In most cases, applies to Windows 10, version 1511 and Windows 10, version 1507 only. Tells how to change the TPM owner password. |
|
||||
| [View status, clear, or troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md) | Describes actions you can take through the TPM snap-in, TPM.msc: view TPM status, troubleshoot TPM initialization, and clear keys from the TPM. Also, for TPM 1.2 and Windows 10, version 1507 or 1511, describes how to turn the TPM on or off. |
|
||||
| [Troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md) | Describes actions you can take through the TPM snap-in, TPM.msc: view TPM status, troubleshoot TPM initialization, and clear keys from the TPM. Also, for TPM 1.2 and Windows 10, version 1507 or 1511, describes how to turn the TPM on or off. |
|
||||
| [Understanding PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md) | Provides background about what happens when you switch PCR banks on TPM 2.0 devices. |
|
||||
| [TPM recommendations](tpm-recommendations.md) | Discusses aspects of TPMs such as the difference between TPM 1.2 and 2.0, and the Windows 10 features for which a TPM is required or recommended. |
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
ms.date: 04/19/2017
|
||||
ms.date: 08/27/2018
|
||||
---
|
||||
|
||||
# Interactive logon: Number of previous logons to cache (in case domain controller is not available)
|
||||
@ -42,7 +42,7 @@ encrypting the information and keeping the cached credentials in the system's re
|
||||
|
||||
### Best practices
|
||||
|
||||
It is advisable to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 0. Setting this value to 0 disables the local caching of logon information. Additional countermeasures include enforcing strong password policies and physically securing the computers. If the value is set to 0, users will be unable to log on to any computers if there is no domain controller available to authenticate them. Organizations might want to set **Interactive logon: Number of previous logons to cache (in case domain controller is not available)** to 2 for end-user systems, especially for mobile users. Setting this value to 2 means that the user's logon information will still be in the cache even if a member of the IT department has recently logged on to their device to perform system maintenance. This way, those users will be able to log on to their devices when they are not connected to the corporate network.
|
||||
The [Windows security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines) do not recommend configuring this setting.
|
||||
|
||||
### Location
|
||||
|
||||
@ -57,7 +57,7 @@ The following table lists the actual and effective default values for this polic
|
||||
| Default Domain Policy| Not defined|
|
||||
| Default Domain Controller Policy | Not defined|
|
||||
| Stand-Alone Server Default Settings | 10 logons|
|
||||
| DC Effective Default Settings | 10 logons|
|
||||
| DC Effective Default Settings | No effect|
|
||||
| Member Server Effective Default Settings | 10 logons|
|
||||
| Client Computer Effective Default Settings| 10 logons|
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 09/11/2018
|
||||
---
|
||||
|
||||
# Review event logs and error codes to troubleshoot issues with Windows Defender Antivirus
|
||||
@ -1417,10 +1417,10 @@ Antivirus client health report.
|
||||
<dt>Antispyware signature creation time: ?<Antispyware signature creation time></dt>
|
||||
<dt>Last quick scan start time: ?<Last quick scan start time></dt>
|
||||
<dt>Last quick scan end time: ?<Last quick scan end time></dt>
|
||||
<dt>Last quick scan source: <Last quick scan source> (1 = scheduled, 2 = on demand)</dt>
|
||||
<dt>Last quick scan source: <Last quick scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)</dt>
|
||||
<dt>Last full scan start time: ?<Last full scan start time></dt>
|
||||
<dt>Last full scan end time: ?<Last full scan end time></dt>
|
||||
<dt>Last full scan source: <Last full scan source> (1 = scheduled, 2 = on demand)</dt>
|
||||
<dt>Last full scan source: <Last full scan source> (0 = scan didn't run, 1 = user initiated, 2 = system initiated)</dt>
|
||||
<dt>Product status: For internal troubleshooting
|
||||
</dl>
|
||||
</td>
|
||||
|
||||
@ -10,15 +10,13 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 05/29/2018
|
||||
ms.date: 09/12/2018
|
||||
---
|
||||
|
||||
|
||||
# Configure machine proxy and Internet connectivity settings
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
@ -46,18 +44,24 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
||||
## Configure the proxy server manually using a registry-based static proxy
|
||||
Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report diagnostic data and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet.
|
||||
|
||||
The static proxy is configurable through Group Policy (GP). The group policy can be found under: **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**.
|
||||
The static proxy is configurable through Group Policy (GP). The group policy can be found under:
|
||||
- Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service
|
||||
- Set it to **Enabled** and select **Disable Authenticated Proxy usage**:
|
||||
|
||||
- **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**:
|
||||
- Configure the proxy:<br>
|
||||
|
||||
|
||||
The policy sets two registry values `TelemetryProxyServer` as REG_SZ and `DisableEnterpriseAuthProxy` as REG_DWORD under the registry key `HKLM\Software\Policies\Microsoft\Windows\DataCollection`.
|
||||
The policy sets two registry values `TelemetryProxyServer` as REG_SZ and `DisableEnterpriseAuthProxy` as REG_DWORD under the registry key `HKLM\Software\Policies\Microsoft\Windows\DataCollection`.
|
||||
|
||||
The registry value `TelemetryProxyServer` takes the following string format:
|
||||
The registry value `TelemetryProxyServer` takes the following string format:
|
||||
|
||||
```text
|
||||
<server name or ip>:<port>
|
||||
```
|
||||
For example: 10.0.0.6:8080
|
||||
```text
|
||||
<server name or ip>:<port>
|
||||
```
|
||||
For example: 10.0.0.6:8080
|
||||
|
||||
The registry value `DisableEnterpriseAuthProxy` should be set to 1.
|
||||
The registry value `DisableEnterpriseAuthProxy` should be set to 1.
|
||||
|
||||
## Configure the proxy server manually using netsh command
|
||||
|
||||
@ -82,7 +86,7 @@ For example: netsh winhttp set proxy 10.0.0.6:8080
|
||||
## Enable access to Windows Defender ATP service URLs in the proxy server
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service in port 80 and 443:
|
||||
|
||||
>![NOTE]
|
||||
>[!NOTE]
|
||||
> URLs that include v20 in them are only needed if you have Windows 10, version 1803 or later machines. For example, ```us-v20.events.data.microsoft.com``` is only needed if the machine is on Windows 10, version 1803 or later.
|
||||
|
||||
Service location | Microsoft.com DNS record
|
||||
@ -124,14 +128,14 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
|
||||
|
||||
6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. <br><br>
|
||||
The tool checks the connectivity of Windows Defender ATP service URLs that Windows Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Windows Defender ATP services. For example:
|
||||
```text
|
||||
Testing URL : https://xxx.microsoft.com/xxx
|
||||
1 - Default proxy: Succeeded (200)
|
||||
2 - Proxy auto discovery (WPAD): Succeeded (200)
|
||||
3 - Proxy disabled: Succeeded (200)
|
||||
4 - Named proxy: Doesn't exist
|
||||
5 - Command line proxy: Doesn't exist
|
||||
```
|
||||
```text
|
||||
Testing URL : https://xxx.microsoft.com/xxx
|
||||
1 - Default proxy: Succeeded (200)
|
||||
2 - Proxy auto discovery (WPAD): Succeeded (200)
|
||||
3 - Proxy disabled: Succeeded (200)
|
||||
4 - Named proxy: Doesn't exist
|
||||
5 - Command line proxy: Doesn't exist
|
||||
```
|
||||
|
||||
If at least one of the connectivity options returns a (200) status, then the Windows Defender ATP client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
@ -58,8 +58,8 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block only Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
Block only Office communication applications from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
|
||||
The rules apply to the following Office apps:
|
||||
|
||||
|
||||
@ -62,8 +62,8 @@ Use advanced protection against ransomware | [!include[Check mark yes](images/sv
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | [!include[Check mark no](images/svg/check-no.svg)] | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | [!include[Check mark yes](images/svg/check-yes.svg)] | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | [!include[Check mark yes](images/svg/check-yes.svg)] | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block only Office communication applications from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
Block only Office communication applications from creating child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
|
||||
|
||||
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
|
||||
|
||||
@ -63,8 +63,8 @@ Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d3
|
||||
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
||||
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
||||
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
||||
Block only Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
Block only Office communication applications from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
||||
Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
||||
|
||||
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user