mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 03:43:39 +00:00
Merge branch 'main' of https://github.com/MicrosoftDocs/windows-docs-pr into dep-vbsencl-9693593
This commit is contained in:
Meghan Stewart
@ -470,7 +470,7 @@ You can configure devices using the [Start CSP][WIN-1]. Use one of the following
|
||||
|
||||
[!INCLUDE [provisioning-package-1](../../../includes/configure/provisioning-package-1.md)]
|
||||
|
||||
- **Path:** `Policies/Start/StartLayout`
|
||||
- **Path:** Policies > Start > StartLayout
|
||||
- **Value:** content of the XML file
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
ms.date: 09/06/2024
|
||||
title: Access Control overview
|
||||
ms.date: 04/07/2025
|
||||
title: Access Control Overview
|
||||
description: Learn about access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer.
|
||||
ms.topic: overview
|
||||
appliesto:
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
title: Local Accounts
|
||||
description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
|
||||
ms.topic: concept-article
|
||||
@ -225,33 +225,33 @@ The following table shows the Group Policy and registry settings that are used t
|
||||
#### To enforce local account restrictions for remote access
|
||||
|
||||
1. Start the **Group Policy Management** Console (GPMC)
|
||||
1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects > New**
|
||||
1. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer
|
||||
1. In the details pane, right-click <**gpo\_name**>, and > **Edit**
|
||||
1. In the **New GPO** dialog box, type <**gpo_name**>, and > **OK** where *gpo_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer
|
||||
1. In the details pane, right-click <**gpo_name**>, and > **Edit**
|
||||
1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps:
|
||||
|
||||
- Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**
|
||||
- Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**
|
||||
- Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**
|
||||
- Navigate to the **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**
|
||||
- Select **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**
|
||||
- Select **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**
|
||||
|
||||
1. Ensure that the local account restrictions are applied to network interfaces by following these steps:
|
||||
|
||||
- Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry**
|
||||
- Right-click **Registry**, and > **New** > **Registry Item**
|
||||
- Right-click **Registry**, and > **New** > **Registry Item**
|
||||
- In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**
|
||||
- Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE**
|
||||
- Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`
|
||||
- Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`
|
||||
- In the **Value name** area, type `LocalAccountTokenFilterPolicy`
|
||||
- In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value
|
||||
- In the **Value data** box, ensure that the value is set to **0**
|
||||
- Verify this configuration, and > **OK**
|
||||
- Verify this configuration, and > **OK**
|
||||
|
||||
1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following:
|
||||
|
||||
- Navigate to the `*Forest*\<Domains>\*Domain*\*OU*` path
|
||||
- Right-click the **Workstations > Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
|
||||
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
|
||||
1. Create links to all other OUs that contain workstations
|
||||
@ -278,23 +278,23 @@ The following table shows the Group Policy settings that are used to deny networ
|
||||
#### To deny network logon to all local administrator accounts
|
||||
|
||||
1. Start the **Group Policy Management** Console (GPMC)
|
||||
1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects**, and > **New**
|
||||
1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer
|
||||
1. In the details pane, right-click <**gpo\_name**>, and > **Edit**
|
||||
1. In the console tree, expand <*Forest*>\Domains\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO)
|
||||
1. In the console tree, right-click **Group Policy Objects**, and > **New**
|
||||
1. In the **New GPO** dialog box, type <**gpo_name**>, and then > **OK** where *gpo_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer
|
||||
1. In the details pane, right-click <**gpo_name**>, and > **Edit**
|
||||
1. Configure the user rights to deny network logons for administrative local accounts as follows:
|
||||
1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment**
|
||||
1. Navigate to the Computer Configuration\Windows Settings\Security Settings\, and > **User Rights Assignment**
|
||||
1. Double-click **Deny access to this computer from the network**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows:
|
||||
1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment**
|
||||
1. Navigate to Computer Configuration\Policies\Windows Settings and Local Policies, and then select **User Rights Assignment**
|
||||
1. Double-click **Deny log on through Remote Desktop Services**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**
|
||||
1. Link the GPO to the first **Workstations** OU as follows:
|
||||
|
||||
- Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path
|
||||
- Right-click the **Workstations** OU, and > **Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
- Navigate to the <*Forest*>\Domains\<*Domain*>\OU path
|
||||
- Right-click the **Workstations** OU, and > **Link an existing GPO**
|
||||
- Select the GPO that you created, and > **OK**
|
||||
|
||||
1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy
|
||||
1. Create links to all other OUs that contain workstations
|
||||
|
||||
@ -1,10 +1,10 @@
|
||||
---
|
||||
title: Support for passkeys in Windows
|
||||
title: Support for Passkeys in Windows
|
||||
description: Learn about passkeys and how to use them on Windows devices.
|
||||
ms.collection:
|
||||
- tier1
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
appliesto:
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 11</a>
|
||||
- ✅ <a href=https://learn.microsoft.com/windows/release-health/supported-versions-windows-client target=_blank>Windows 10</a>
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Deploy Virtual Smart Cards
|
||||
description: Learn about what to consider when deploying a virtual smart card authentication solution
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Deploy Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Evaluate Virtual Smart Card Security
|
||||
description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Evaluate Virtual Smart Card Security
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Get Started with Virtual Smart Cards - Walkthrough Guide
|
||||
description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards.
|
||||
ms.topic: get-started
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Get Started with Virtual Smart Cards: Walkthrough Guide
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Virtual Smart Card Overview
|
||||
description: Learn about virtual smart card technology for Windows.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Virtual Smart Card Overview
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Tpmvscmgr
|
||||
description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer.
|
||||
ms.topic: reference
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Tpmvscmgr
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Understanding and Evaluating Virtual Smart Cards
|
||||
description: Learn how smart card technology can fit into your authentication design.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Understand and Evaluate Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Use Virtual Smart Cards
|
||||
description: Learn about the requirements for virtual smart cards, how to use and manage them.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Use Virtual Smart Cards
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Configure Windows Firewall logging
|
||||
description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Configure Windows Firewall logging
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Manage Windows Firewall with the command line
|
||||
title: Manage Windows Firewall With the Command Line
|
||||
description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Manage Windows Firewall with the command line
|
||||
@ -53,7 +53,7 @@ netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFile
|
||||
|
||||
### Disable Windows Firewall
|
||||
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
|
||||
|
||||
- Start menu can stop working
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Configure firewall rules with group policy
|
||||
title: Configure Firewall Rules With Group Policy
|
||||
description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Configure rules with group policy
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Windows Firewall dynamic keywords
|
||||
title: Windows Firewall Dynamic Keywords
|
||||
description: Learn about Windows Firewall dynamic keywords and how to configure it using Windows PowerShell.
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Windows Firewall dynamic keywords
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Filter origin audit log
|
||||
title: Filter Origin Audit Log
|
||||
description: Learn about Windows Firewall and filter origin audit log to troubleshoot packet drops.
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Filter origin audit log
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Hyper-V firewall
|
||||
title: Hyper-V Firewall
|
||||
description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP).
|
||||
ms.topic: how-to
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
appliesto:
|
||||
- ✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 11</a>
|
||||
---
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Windows Firewall overview
|
||||
title: Windows Firewall Overview
|
||||
description: Learn overview information about the Windows Firewall security feature.
|
||||
ms.topic: overview
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Windows Firewall overview
|
||||
@ -75,7 +75,7 @@ The *public network* profile is designed with higher security in mind for public
|
||||
|
||||
## Disable Windows Firewall
|
||||
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
Microsoft recommends that you don't disable Windows Firewall because you lose other benefits, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, Windows Service Hardening, and [boot time filters][BTF]. Non-Microsoft firewall software can programmatically disable only the [rule types][FWRC] of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose.
|
||||
If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the Services snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Firewall service isn't supported by Microsoft and can cause problems, including:
|
||||
|
||||
- Start menu can stop working
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
---
|
||||
title: Quarantine behavior
|
||||
title: Quarantine Behavior
|
||||
description: Learn about Windows Firewall and the quarantine feature behavior.
|
||||
ms.topic: concept-article
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Quarantine behavior
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Firewall rules
|
||||
title: Windows Firewall Rules
|
||||
description: Learn about Windows Firewall rules and design recommendations.
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: concept-article
|
||||
---
|
||||
|
||||
@ -21,7 +21,7 @@ In many cases, allowing specific types of inbound traffic is required for applic
|
||||
|
||||
Because of 1 and 2, when designing a set of policies, you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow.
|
||||
|
||||
Outbound rules follow the same precedence behaviors.
|
||||
Outbound rules follow the same precedence behaviors.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described.
|
||||
@ -33,12 +33,12 @@ When first installed, network applications and services issue a *listen call* sp
|
||||
:::row:::
|
||||
:::column span="2":::
|
||||
If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network:
|
||||
|
||||
|
||||
- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic
|
||||
- If the user isn't a local admin and they are prompted, block rules are created. It doesn't matter what option is selected
|
||||
|
||||
To disable the notification prompt, you can use the [command line](/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line) or the **Windows Firewall with Advanced Security** console
|
||||
|
||||
|
||||
:::column-end:::
|
||||
:::column span="2":::
|
||||
:::image type="content" source="images/uac.png" alt-text="Screenshot showing the User Account Control (UAC) prompt to allow Microsoft Teams." border="false":::
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Firewall tools
|
||||
title: Windows Firewall Tools
|
||||
description: Learn about the available tools to configure Windows Firewall and firewall rules.
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
ms.topic: best-practice
|
||||
---
|
||||
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Troubleshooting UWP App Connectivity Issues in Windows Firewall
|
||||
description: Troubleshooting UWP App Connectivity Issues in Windows Firewall
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 09/06/2024
|
||||
ms.date: 04/07/2025
|
||||
---
|
||||
|
||||
# Troubleshooting UWP App Connectivity Issues
|
||||
|
||||
Reference in New Issue
Block a user