mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into diagnostic-data-1803
This commit is contained in:
Brian Lich
commit
c208719310
@ -16,6 +16,12 @@ ms.localizationpriority: medium
|
||||
|
||||
This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
|
||||
|
||||
## April 2018
|
||||
|
||||
New or changed topic | Description
|
||||
--- | ---
|
||||
[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated instructions for Skype for Business Hybrid.
|
||||
|
||||
## March 2018
|
||||
|
||||
New or changed topic | Description
|
||||
|
||||
@ -9,13 +9,17 @@ ms.sitesec: library
|
||||
ms.pagetype: surfacehub
|
||||
author: jdeckerms
|
||||
ms.author: jdecker
|
||||
ms.date: 02/21/2018
|
||||
ms.date: 04/12/2018
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
|
||||
# Hybrid deployment (Surface Hub)
|
||||
A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
|
||||
|
||||
>[!NOTE]
|
||||
>In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
|
||||
|
||||
<span id="exchange-on-prem" />
|
||||
## Exchange on-premises
|
||||
Use this procedure if you use Exchange on-premises.
|
||||
|
||||
@ -210,15 +214,10 @@ If your organization has set up [hybrid connectivity between Skype for Business
|
||||
|
||||
The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
|
||||
|
||||
In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet, unfortunately this will not work between the on-preisesm Skype server and Office 365 - it only works across on-premises Skype pools.
|
||||
In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
|
||||
|
||||
To have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. Enable the account on the on-premises Skype server first:
|
||||
|
||||
```
|
||||
Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365.](https://technet.microsoft.com/library/jj204969.aspx)
|
||||
>[!NOTE]
|
||||
>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
|
||||
|
||||
## Exchange online
|
||||
@ -406,13 +405,8 @@ If your organization has set up [hybrid connectivity between Skype for Business
|
||||
|
||||
The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
|
||||
|
||||
In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&MSPPError=-2147217396) cmdlet, unfortunately this will not work between the on-premises Skype server and Office 365 - it only works across on-premises Skype pools.
|
||||
|
||||
In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-premises](#exchange-on-premises) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-premises Skype server:
|
||||
In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
|
||||
|
||||
```PowerShell
|
||||
Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName
|
||||
```
|
||||
|
||||
After the Surface Hub account is enabled for Skype for Business on-premises, you can keep the account on-premises or you can move the Surface Hub account to Office 365, using the Move-CsUser cmdlet. [Learn more about moving a Skype user to Office 365](https://technet.microsoft.com/library/jj204969.aspx).
|
||||
>[!NOTE]
|
||||
>To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
|
||||
|
||||
|
||||
@ -36,9 +36,10 @@ Additionally, note that Surface Hub requires the following open ports:
|
||||
- HTTP: 80
|
||||
- NTP: 123
|
||||
|
||||
Depending on your environment, access to additional ports may be needed:
|
||||
- For online environments, see [Office 365 IP URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
|
||||
- For on-premises installations, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
|
||||
If you are using Surface Hub with Skype for Business, you will need to open additional ports. Please follow the guidance below:
|
||||
- If you use Skype for Business Online, see [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
|
||||
- If you use Skype for Business Server, see [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
|
||||
- If you use a hybrid of Skype for Business Online and Skype for Business Server, you need to open all documented ports from [Office 365 IP URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) and [Skype for Business Server: Ports and protocols for internal servers](https://technet.microsoft.com/library/gg398833.aspx).
|
||||
|
||||
Microsoft collects diagnostic data to help improve your Surface Hub experience. Add these sites to your allow list:
|
||||
- Diagnostic data client endpoint: `https://vortex.data.microsoft.com/`
|
||||
|
||||
@ -94,7 +94,7 @@ Restoring a user’s device restores the currently registered Template’s setti
|
||||
|
||||
- **Manual Restore**
|
||||
|
||||
If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command ensures that the user’s current settings become the current state on the Settings Storage Location.
|
||||
If you want to assist users by restoring a device during a refresh, you can choose to use the Restore-UevBackup cmdlet. This command causes the user’s settings to be downloaded from the Settings Storage Location.
|
||||
|
||||
## Restore Application and Windows Settings to Original State
|
||||
|
||||
|
||||
@ -4,9 +4,9 @@
|
||||
## [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md)
|
||||
## [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
## [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
|
||||
## [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
|
||||
## [Windows 10, version 1709 diagnostic data for the Full telemetry level](windows-diagnostic-data.md)
|
||||
## [Windows 10, version 1703 diagnostic data for the Full telemetry level](windows-diagnostic-data-1703.md)
|
||||
## [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
|
||||
## [Windows 10, version 1709 diagnostic data for the Full level](windows-diagnostic-data.md)
|
||||
## [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
|
||||
## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
|
||||
## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
|
||||
## [Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md)
|
||||
|
||||
@ -16,8 +16,8 @@ ms.date: 03/08/2018
|
||||
|
||||
Follow the steps in this topic to deploy User Experience Virtualization (UE-V) for the first time in a test environment. Evaluate UE-V to determine whether it’s the right solution to manage user settings across multiple devices within your enterprise.
|
||||
|
||||
>**Note**
|
||||
The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md).
|
||||
>[!NOTE]
|
||||
>The information in this section is explained in greater detail throughout the rest of the documentation. If you’ve already determined that UE-V is the right solution and you don’t need to further evaluate it, see [Prepare a UE-V deployment](uev-prepare-for-deployment.md).
|
||||
|
||||
The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows applications settings. For best results, ensure that your test environment includes two or more user computers that share network access.
|
||||
|
||||
@ -94,13 +94,13 @@ A storage path must be configured on the client-side to tell where the personali
|
||||
|
||||
4. Select **Enabled**, fill in the **Settings storage path**, and click **OK**.
|
||||
|
||||
- Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder.
|
||||
- Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder.
|
||||
|
||||
**To set the storage path for UE-V with PowerShell**
|
||||
|
||||
1. In a PowerShell window, type **Set-uevConfiguration -SettingsStoragePath [StoragePath]** where **[StoragePath]** is the path to the location created in step 2 followed by **\%username%**.
|
||||
|
||||
- Ensure that the storage path ends with **%username%** to ensure that eah user gets a unique folder.
|
||||
- Ensure that the storage path ends with **%username%** to ensure that each user gets a unique folder.
|
||||
|
||||
With Windows 10, version 1607 and later, the UE-V service is installed on user devices when the operating system is installed. Enable the service to start using UE-V. You can enable the service with the Group Policy editor or with Windows PowerShell.
|
||||
|
||||
|
||||
@ -13,6 +13,10 @@ ms.date: 03/27/2018
|
||||
# Delivery Optimization in Update Compliance
|
||||
The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days.
|
||||
|
||||
>[!Note]
|
||||
>Delivery Optimization Status is currently in development. See the [Known Issues](#known-issues) section for issues we are aware of and potential workarounds.
|
||||
|
||||
|
||||
## Delivery Optimization Status
|
||||
|
||||
The Delivery Optimization Status section includes three blades:
|
||||
@ -40,3 +44,8 @@ The download sources that could be included are:
|
||||
- Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used)
|
||||
- HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates.
|
||||
|
||||
## Known Issues
|
||||
Delivery Optimization is currently in development. The following issues are known:
|
||||
|
||||
- DO Download Mode is not accurately portrayed in the Device Configuration blade. There is no workaround at this time.
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ ms.date: 04/03/2018
|
||||
|
||||
# Frequently asked questions and troubleshooting Windows Analytics
|
||||
|
||||
This topic compiles the most common issues encountered with configuring and using Windows Analytics, as well as general questions.
|
||||
This topic compiles the most common issues encountered with configuring and using Windows Analytics, as well as general questions. This FAQ, along with the [Windows Analytics Technical Community](https://techcommunity.microsoft.com/t5/Windows-Analytics/ct-p/WindowsAnalytics), are recommended resources to consult before contacting Microsoft support.
|
||||
|
||||
## Troubleshooting common problems
|
||||
|
||||
|
||||
@ -127,7 +127,6 @@ Use a software distribution system such as System Center Configuration Manager t
|
||||
|
||||
### Distributing policies at scale
|
||||
There are a number of policies that can be centrally managed to control Windows Analytics device configuration. All of these policies have *preference* registry key equivalents that can be set by using the deployment script. Policy settings override preference settings if both are set.
|
||||
|
||||
>[!NOTE]
|
||||
>You can only set the diagnostic data level to Enhanced by using policy. For example, this is necessary for using Device Health.
|
||||
|
||||
@ -155,4 +154,10 @@ For more information about Internet Explorer Security Zones, see [About URL Secu
|
||||
|
||||
### Distribution at scale without using the deployment script
|
||||
|
||||
We recommend using the deployment script to configure devices. However if this is not an option, you can still manage settings by policy as described in the previous section. However, if you don't run the deployment script, you might have to wait a long time (possibly weeks) before devices send the initial full inventory scan.
|
||||
We recommend using the deployment script to configure devices. However if this is not an option, you can still manage settings by policy as described in the previous section. However, if you don't run the deployment script, you won't benefit from its error checking, and you might have to wait a long time (possibly weeks) before devices send the initial full inventory scan.
|
||||
|
||||
Note that it is possible to intiate a full inventory scan on a device by calling these commands:
|
||||
- CompatTelRunner.exe -m:generaltel.dll -f:DoCensusRun
|
||||
- CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun ent
|
||||
|
||||
For details on how to run these and how to check results, see the deployment script.
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.date: 03/30/2018
|
||||
ms.date: 04/11/2018
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
@ -103,7 +103,7 @@ SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /Mode:Offline /LogsPath:D:\Dump
|
||||
|
||||
## Known issues
|
||||
|
||||
1. Some rules can take a long time to process if the log files involved as large.
|
||||
1. Some rules can take a long time to process if the log files involved are large.
|
||||
2. SetupDiag only outputs data in a text format. If another format is desired, please provide this [feedback](#feedback).
|
||||
3. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode.
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ See [Windows 10 Specifications](http://www.microsoft.com/en-US/windows/windows-1
|
||||
Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates.
|
||||
The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com).
|
||||
|
||||
Windows 10 LTSB is not supported by Upgrade Readiness. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not compatible with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSB.
|
||||
While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC.
|
||||
|
||||
## Operations Management Suite
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ Passwords are still weak. We recommend that in addition to deploying Windows Def
|
||||
Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported.
|
||||
|
||||
## Wi-fi and VPN Considerations
|
||||
When you enable Windows Defender Credential Guard, you can no longer use NTLM classic deployment model authentication. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
|
||||
When you enable Windows Defender Credential Guard, you can no longer use NTLM classic authentication for Single Sign-On. You will be forced to enter your credentials to use these protocols and cannot save the credentials for future use. If you are using WiFi and VPN endpoints that are based on MS-CHAPv2, they are subject to similar attacks as for NTLMv1. For WiFi and VPN connections, Microsoft recommends that organizations move from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS.
|
||||
|
||||
## Kerberos Considerations
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ This topic explains how BitLocker Device Encryption can help protect data on de
|
||||
For an architectural overview about how BitLocker Device Encryption works with Secure Boot, see [Secure boot and BitLocker Device Encryption overview](https://docs.microsoft.com/windows-hardware/drivers/bringup/secure-boot-and-device-encryption-overview).
|
||||
For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md).
|
||||
|
||||
When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives; in Windows 10, BitLocker will even protect individual files, with data loss prevention capabilities. Windows consistently improves data protection by improving existing options and by providing new strategies.
|
||||
When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies.
|
||||
|
||||
Table 2 lists specific data-protection concerns and how they are addressed in Windows 10 and Windows 7.
|
||||
|
||||
|
||||
@ -336,7 +336,7 @@ To use Network Unlock you must also have a PIN configured for your computer. Whe
|
||||
BitLocker Network Unlock has software and hardware requirements for both client computers, Windows Deployment services, and domain controllers that must be met before you can use it.
|
||||
|
||||
Network Unlock uses two protectors, the TPM protector and the one provided by the network or by your PIN, whereas automatic unlock uses a single protector, the one stored in the TPM. If the computer is joined to a network without the key protector it will prompt you to enter your PIN. If the PIN is
|
||||
not available you will need to use the recovery key to unlock the computer if it can ot be connected to the network.
|
||||
not available you will need to use the recovery key to unlock the computer if it can not be connected to the network.
|
||||
|
||||
For more info, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md).
|
||||
|
||||
|
||||
@ -108,7 +108,7 @@ For Azure AD-joined computers, including virtual machines, the recovery password
|
||||
```
|
||||
PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
|
||||
|
||||
PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:”
|
||||
PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:"
|
||||
|
||||
PS C:\>BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId
|
||||
```
|
||||
@ -118,7 +118,7 @@ For domain-joined computers, including servers, the recovery password should be
|
||||
```
|
||||
PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
|
||||
|
||||
PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:”
|
||||
PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:"
|
||||
|
||||
PS C:\>Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId
|
||||
```
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 9.9 KiB |
@ -175,7 +175,7 @@ To gain the most value out of the baseline subscription we recommend to have the
|
||||
- Enable disabled event channels and set the minimum size for modern event files.
|
||||
- Currently, there is no GPO template for enabling or setting the maximum size for the modern event files. This must be done by using a GPO. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc).
|
||||
|
||||
The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Baseline Subscription Event Query](#bkmk-appendixf).
|
||||
The annotated event query can be found in the following. For more info, see [Appendix F – Annotated Suspect Subscription Event Query](#bkmk-appendixf).
|
||||
|
||||
- Anti-malware events from Microsoft Antimalware or Windows Defender. This can be configured for any given anti-malware product easily if it writes to the Windows event log.
|
||||
- Security event log Process Create events.
|
||||
|
||||
@ -82,7 +82,7 @@ Hiding notifications can be useful in situations where you cannot hide the entir
|
||||
> [!NOTE]
|
||||
> Hiding notifications will only occur on endpoints to which the policy has been deployed. Notifications related to actions that must be taken (such as a reboot) will still appear on the [System Center Configuration Manager Endpoint Protection monitoring dashboard and reports](https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection).
|
||||
|
||||
See the [Customize the Windows Defender Security Center app for your organization](/windows/threat-protection/windows-defender-security-center/windows-defender-security-center-antivirus) topic for instructions to add custom contact information to the notifications that users see on their machines.
|
||||
See the [Customize the Windows Defender Security Center app for your organization](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md) topic for instructions to add custom contact information to the notifications that users see on their machines.
|
||||
|
||||
**Use Group Policy to hide notifications:**
|
||||
|
||||
|
||||
@ -9,9 +9,9 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: iaanw
|
||||
ms.author: iawilt
|
||||
ms.date: 10/12/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/11/2018
|
||||
---
|
||||
|
||||
|
||||
@ -59,6 +59,9 @@ This topic includes the following instructions for setting up and running Window
|
||||
## Enable or disable the interface on Windows Server 2016
|
||||
By default, Windows Defender AV is installed and functional on Windows Server 2016. The user interface is installed by default on some SKUs, but is not required.
|
||||
|
||||
>[!NOTE]
|
||||
>You can't uninstall the Windows Defender Security Center app, but you can disable the interface with these instructions.
|
||||
|
||||
If the interface is not installed, you can add it in the **Add Roles and Features Wizard** at the **Features** step, under **Windows Defender Features** by selecting the **GUI for Windows Defender** option.
|
||||
|
||||
|
||||
|
||||
@ -30,7 +30,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Net
|
||||
|-----------|------------------|-----------|
|
||||
|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|
||||
|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Notes: 1) Please include a full domain name (www.contoso.com) in the configuration 2) You may optionally use "." as a wildcard character to automatically trust subdomains. Configuring ".constoso.com" will automatically trust "subdomain1.contoso.com", "subdomain2.contoso.com" etc. |
|
||||
|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.|
|
||||
|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment.|
|
||||
|
||||
### Application-specific settings
|
||||
These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard**, can help you to manage your company's implementation of Application Guard.
|
||||
|
||||
@ -13,7 +13,8 @@ ms.date: 10/23/2017
|
||||
# Windows Defender Application Guard overview
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10 Enterprise edition, version 1709
|
||||
- Windows 10 Enterprise edition, version 1709 or higher
|
||||
- Windows 10 Professional edition, version 1803
|
||||
|
||||
The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks.
|
||||
|
||||
@ -27,7 +28,7 @@ If an employee goes to an untrusted site through either Microsoft Edge or Intern
|
||||
|
||||
|
||||
### What types of devices should use Application Guard?
|
||||
Application Guard has been created to target 3 types of enterprise systems:
|
||||
Application Guard has been created to target several types of systems:
|
||||
|
||||
- **Enterprise desktops.** These desktops are domain-joined and managed by your organization. Configuration management is primarily done through System Center Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network.
|
||||
|
||||
@ -35,6 +36,8 @@ Application Guard has been created to target 3 types of enterprise systems:
|
||||
|
||||
- **Bring your own device (BYOD) mobile laptops.** These personally-owned laptops are not domain-joined, but are managed by your organization through tools like Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home.
|
||||
|
||||
- **Personal devices.** These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside.
|
||||
|
||||
## In this section
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
@ -42,4 +45,4 @@ Application Guard has been created to target 3 types of enterprise systems:
|
||||
|[Prepare and install Windows Defender Application Guard](install-wd-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.|
|
||||
|[Configure the Group Policy settings for Windows Defender Application Guard](configure-wd-app-guard.md) |Provides info about the available Group Policy and MDM settings.|
|
||||
|[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Windows Defender Application Guard (Application Guard) in your organization.|
|
||||
|[Frequently Asked Questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Common questions and answers around the features and functionality of Application Guard.|
|
||||
|[Frequently Asked Questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Common questions and answers around the features and functionality of Application Guard.|
|
||||
|
||||
@ -67,18 +67,18 @@ POST /72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/token HTTP/1.1
|
||||
Host: login.microsoftonline.com
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
resource=https%3A%2F%2FWDATPAlertExport.Seville.onmicrosoft.com&client_id=35e0f735-5fe4-4693-9e68-3de80f1d3745&client_secret=IKXc6PxB2eoFNJ%2FIT%2Bl2JZZD9d9032VXz6Ul3D2WyUQ%3D&grant_type=client_credentials
|
||||
resource=https%3A%2F%2Fgraph.windows.net&client_id=35e0f735-5fe4-4693-9e68-3de80f1d3745&client_secret=IKXc6PxB2eoFNJ%2FIT%2Bl2JZZD9d9032VXz6Ul3D2WyUQ%3D&grant_type=client_credentials
|
||||
```
|
||||
The response will include an access token and expiry information.
|
||||
|
||||
```json
|
||||
{
|
||||
"token type": "Bearer",
|
||||
"expires in": "3599"
|
||||
"token_type": "Bearer",
|
||||
"expires_in": "3599",
|
||||
"ext_expires_in": "0",
|
||||
"expires_on": "1488720683",
|
||||
"not_before": "1488720683",
|
||||
"resource": "https://WDATPAlertExport.Seville.onmicrosoft.com",
|
||||
"resource": "https://graph.windows.net",
|
||||
"access_token":"eyJ0eXaioJJOIneiowiouqSuzNiZ345FYOVkaJL0625TueyaJasjhIjEnbMlWqP..."
|
||||
}
|
||||
```
|
||||
@ -117,7 +117,7 @@ Authorization: Bearer <your access token>
|
||||
The following example demonstrates a request to get the last 20 alerts since 2016-09-12 00:00:00.
|
||||
|
||||
```syntax
|
||||
GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc="2016-09-12 00:00:00"
|
||||
GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc=2016-09-12T00:00:00.000
|
||||
Authorization: Bearer <your access token>
|
||||
```
|
||||
|
||||
|
||||
@ -9,9 +9,9 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: iaanw
|
||||
ms.author: iawilt
|
||||
ms.date: 10/17/2017
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 04/11/2018
|
||||
---
|
||||
|
||||
|
||||
@ -39,12 +39,18 @@ In Windows 10, version 1709, we increased the scope of the app to also show info
|
||||
>[!NOTE]
|
||||
>The Windows Defender Security Center app is a client interface on Windows 10, version 1703 and later. It is not the Windows Defender Security Center web portal console that is used to review and manage [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection).
|
||||
|
||||
This library describes the Windows defender Security Center app, and provides information on configuring certain features, inlcuding:
|
||||
This library describes the Windows Defender Security Center app, and provides information on configuring certain features, including:
|
||||
|
||||
<a id="customize-notifications-from-the-windows-defender-security-center"></a>
|
||||
- [Showing and customizing contact information on the app and in notifications](wdsc-customize-contact-information.md)
|
||||
- [Hiding notifications](wdsc-hide-notifications.md)
|
||||
|
||||
You can't uninstall the Windows Defender Security Center app, but you can do one of the following:
|
||||
|
||||
- Disable the interface on Windows Server 2016. See [Windows Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016).
|
||||
- Hide all of the sections on client computers (see below).
|
||||
- Disable Windows Defender Antivirus, if needed. See [Enable and configure Windows Defender AV always-on protection and monitoring](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus).
|
||||
|
||||
You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics:
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user