diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index c975833477..4993abaec4 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -2043,12 +2043,12 @@ }, { "source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", "redirect_document_id": false }, { @@ -6112,10 +6112,10 @@ "redirect_document_id": false }, { - "source_path": "education/windows/swithc-to-pro-de.md", - "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", - "redirect_document_id": false - }, +"source_path": "education/windows/swithc-to-pro-de.md", +"redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", +"redirect_document_id": false +}, { "source_path": "windows/client-management/mdm/policy-admx-backed.md", "redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", @@ -6212,14 +6212,14 @@ "redirect_document_id": true }, { - "source_path": "devices/hololens/hololens-restart-recover.md", - "redirect_url": "/hololens/hololens-recovery", - "redirect_document_id": false +"source_path": "devices/hololens/hololens-restart-recover.md", +"redirect_url": "/hololens/hololens-recovery", +"redirect_document_id": false }, { - "source_path": "devices/hololens/holographic-photos-and-video.md", - "redirect_url": "/hololens/holographic-photos-and-videos", - "redirect_document_id": false +"source_path": "devices/hololens/holographic-photos-and-video.md", +"redirect_url": "/hololens/holographic-photos-and-videos", +"redirect_document_id": false }, { "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", @@ -9388,17 +9388,17 @@ }, { "source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9418,12 +9418,12 @@ }, { "source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9438,7 +9438,7 @@ }, { "source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9468,12 +9468,12 @@ }, { "source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9488,27 +9488,27 @@ }, { "source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9518,12 +9518,12 @@ }, { "source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9533,7 +9533,7 @@ }, { "source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9573,7 +9573,7 @@ }, { "source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", "redirect_document_id": true }, { @@ -9788,7 +9788,7 @@ }, { "source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9883,7 +9883,7 @@ }, { "source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9893,7 +9893,7 @@ }, { "source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9903,7 +9903,7 @@ }, { "source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -9913,7 +9913,7 @@ }, { "source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -10073,7 +10073,7 @@ }, { "source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -10143,7 +10143,7 @@ }, { "source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -11778,12 +11778,12 @@ }, { "source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -11793,12 +11793,12 @@ }, { "source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -11813,12 +11813,12 @@ }, { "source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12293,7 +12293,7 @@ }, { "source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12398,7 +12398,7 @@ }, { "source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12458,12 +12458,12 @@ }, { "source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12473,7 +12473,7 @@ }, { "source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12643,7 +12643,7 @@ }, { "source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12858,17 +12858,17 @@ }, { "source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12888,7 +12888,7 @@ }, { "source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -12983,7 +12983,7 @@ }, { "source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", "redirect_document_id": true }, { @@ -13103,27 +13103,27 @@ }, { "source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-offline.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-offline", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", -"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", "redirect_document_id": true }, { @@ -15990,6 +15990,261 @@ "source_path": "windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus", "redirect_document_id": true -} +}, +{ + "source_path": "windows/security/threat-protection/windows-defender-antivirus/antivirus-false-positives-negatives.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-notifications-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-server-exclusions-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/evaluate-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/windows-defender-offline", + "redirect_document_id": true + }, + { + "source_path": "windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", + "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus", + "redirect_document_id": true + } ] } diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index ceb4d9b0f2..060f6ffb99 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -188,5 +188,4 @@ ### [Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) ## KB Troubleshoot -### [Clear the Internet Explorer cache from a command line](kb-support/clear-ie-cache-from-command-line.md) ### [Internet Explorer and Microsoft Edge FAQ for IT Pros](kb-support/ie-edge-faqs.md) diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.md b/browsers/internet-explorer/kb-support/ie-edge-faqs.md index ef07a2a337..0257a9db03 100644 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.md +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.md @@ -1,6 +1,6 @@ --- title: IE and Microsoft Edge FAQ for IT Pros -description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. +description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. audience: ITPro manager: msmets author: ramakoni1 diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b8eb37197c..3a48ac399e 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -14,8 +14,6 @@ ms.date: 09/18/2018 # AssignedAccess CSP -**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** - The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a kiosk on Windows 10 Pro, Enterprise, or Education.](https://go.microsoft.com/fwlink/p/?LinkID=722211) diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index 19421997ba..edf7ea7a4b 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -14,9 +14,6 @@ manager: dansimp # BitLocker DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **BitLocker** configuration service provider. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index f93af2f2a2..59751b300b 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/11/2020 +ms.date: 06/03/2020 --- # Configuration service provider reference -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - A configuration service provider (CSP) is an interface to read, set, modify, or delete configuration settings on the device. These settings map to registry keys or files. Some configuration service providers support the WAP format, some support SyncML, and some support both. SyncML is only used over–the–air for Open Mobile Alliance Device Management (OMA DM), whereas WAP can be used over–the–air for OMA Client Provisioning, or it can be included in the phone image as a .provxml file that is installed during boot. For information about the bridge WMI provider classes that map to these CSPs, see [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224). For CSP DDF files, see [CSP DDF files download](#csp-ddf-files-download). @@ -2699,6 +2696,7 @@ Additional lists: ## CSP DDF files download You can download the DDF files for various CSPs from the links below: +- [Download all the DDF files for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/Windows10_2004_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1809](https://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index a9993b1e63..8c398e4992 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -15,9 +15,6 @@ ms.date: 10/21/2019 # Defender CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. The following image shows the Windows Defender configuration service provider in tree format. diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index e5c1dcd59e..6ca8fc6f49 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -15,7 +15,6 @@ ms.date: 10/21/2019 # Defender DDF file - This topic shows the OMA DM device description framework (DDF) for the **Defender** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 47df0219d5..0ab07220b6 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/11/2018 +ms.date: 06/03/2020 --- # DevDetail DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **DevDetail** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). @@ -724,4 +721,5 @@ The XML below is the current version for this CSP. + ``` diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 25b59bccc1..2e1b590d91 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -24,8 +24,8 @@ ms.date: 06/26/2017 # DMProcessConfigXMLFiltered function -> **Important**   -The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. +> [!Important] +> The use of this function for automatic data configuration (ADC) is deprecated in Windows Phone 8.1. Please see [Connectivity configuration](https://msdn.microsoft.com/library/windows/hardware/dn757424) for more information about the new process for provisioning connectivity configuration. However, this function is still supported for other OEM uses. Configures phone settings by using OMA Client Provisioning XML. Use of this function is strictly limited to the following scenarios. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index c9d550f250..aa2cdb680b 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -14,9 +14,6 @@ ms.date: 10/01/2019 # EnterpriseModernAppManagement DDF -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 8a720f94a0..b2ca393530 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -59,6 +59,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [June 2020](#june-2020) - [May 2020](#may-2020) - [February 2020](#february-2020) - [January 2020](#january-2020) @@ -1980,6 +1981,10 @@ What data is handled by dmwappushsvc? | It is a component handling the internal How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation +### June 2020 +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - NetworkIsolation](policy-csp-networkisolation.md)|Updated the description to Integer instead of Boolean for the following policy settings:
EnterpriseIPRangesAreAuthoritative, EnterpriseProxyServersAreAuthoritative| ### May 2020 |New or updated topic | Description| diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 7f8b60345e..88e2b4dee5 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -14,9 +14,6 @@ ms.date: 08/15/2018 # Office DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **Office** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 047fef66ae..3f32491bba 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -15,9 +15,6 @@ ms.date: 07/18/2019 # Policy CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider has the following sub-categories: @@ -4055,8 +4052,8 @@ The following diagram shows the Policy configuration service provider in tree fo ## Policy CSPs supported by Microsoft Surface Hub - [Policy CSPs supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md) -## Policy CSPs that can be set using Exchange Active Sync (EAS) -- [Policy CSPs that can be set using Exchange Active Sync (EAS)](policy-csps-that-can-be-set-using-eas.md) +## Policy CSPs that can be set using Exchange ActiveSync (EAS) +- [Policy CSPs that can be set using Exchange ActiveSync (EAS)](policy-csps-that-can-be-set-using-eas.md) ## Related topics diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index d14be473a2..7a981c49d8 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -74,7 +74,7 @@ manager: dansimp -This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved Activex Install sites specified by host URL. +This policy setting determines which ActiveX installation sites standard users in your organization can use to install ActiveX controls on their computers. When this setting is enabled, the administrator can create a list of approved ActiveX Install sites specified by host URL. If you enable this setting, the administrator can create a list of approved ActiveX Install sites specified by host URL. @@ -109,6 +109,8 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in Windows 10, version 1909. +- 8 - Added in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 96103d4ca7..378f92cb1b 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -12,10 +12,6 @@ ms.date: 09/27/2019 # Policy CSP - Audit -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index d7f56e3f4c..d4c64c584f 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -14,10 +14,6 @@ manager: dansimp # Policy CSP - BITS -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - - The following bandwidth policies are used together to define the bandwidth-throttling schedule and transfer rate. - BITS/BandwidthThrottlingEndTime diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 4b686d7c13..3f68b4b8cb 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -4303,5 +4303,7 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in Windows 10, version 1909. +- 8 - Added in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 003b1ca8d3..d9cc3f9647 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -249,6 +249,8 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. +- 7 - Added in Windows 10, version 1909. +- 8 - Added in Windows 10, version 2004. diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index f34ee27dd5..00ab26dd22 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - DeviceGuard -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 4ced8ce8ab..f1c54d540a 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -14,9 +14,6 @@ ms.localizationpriority: medium # Policy CSP - DeviceInstallation -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 08eaddf872..d553a30d50 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - DmaGuard -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 3f4beef3e9..e316fbdb3f 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Education -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 200fde9087..f61798a6d7 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Kerberos -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 3d7afccb49..601cfb8378 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -228,7 +228,7 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff -Boolean value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. +Integer value that tells the client to accept the configured list and not to use heuristics to attempt to find other subnets. @@ -468,7 +468,7 @@ ADMX Info: -Boolean value that tells the client to accept the configured list of proxies and not try to detect other work proxies. +Integer value that tells the client to accept the configured list of proxies and not try to detect other work proxies. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 4935d3f947..1707ca7bfc 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -14,8 +14,6 @@ manager: dansimp # Policy CSP - RestrictedGroups -> [!WARNING] -> Some information in this article relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 0a4dcd146d..46499d7701 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Security -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index c5e74893fc..17a91ff2d8 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Start -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 8a69418c47..7d502e9af7 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - TaskManager -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index a116d3b084..79e47c91f8 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -16,10 +16,6 @@ manager: dansimp -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 9949285fca..3942b48f24 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - Update -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - > [!NOTE] > If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 4db39b31f2..86ea14fd52 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - WindowsDefenderSecurityCenter -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 8a9c1a34dc..7a522ee312 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -10,7 +10,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 05/21/2019 +ms.date: 06/03/2020 --- # Policy DDF file @@ -20,6 +20,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy* You can view various Policy DDF files by clicking the following links: +- [View the Policy DDF file for Windows 10, version 2004](https://download.microsoft.com/download/4/0/f/40f9ec45-3bea-442c-8afd-21edc1e057d8/PolicyDDF_all_2004.xml) - [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) - [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) - [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) @@ -31,7 +32,7 @@ You can view various Policy DDF files by clicking the following links: You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the DDF for Windows 10, version 1903. +The XML below is the DDF for Windows 10, version 2004. ```xml @@ -57,7 +58,7 @@ The XML below is the DDF for Windows 10, version 1903. - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -1646,7 +1647,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -1657,11 +1658,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -2119,6 +2120,30 @@ Related policy: + + AllowGraphingCalculator + + + + + + + + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + DefaultPrinterName @@ -11023,7 +11048,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -11034,11 +11059,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -11541,6 +11566,33 @@ Related policy: + + AllowGraphingCalculator + + + + + 1 + This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. + + + + + + + + + + + text/plain + + + Programs.admx + Programs~AT~WindowsComponents~Calculator + AllowGraphingCalculator + LowestValueMostSecure + + DefaultPrinterName @@ -19509,7 +19561,7 @@ Related policy: - com.microsoft/9.0/MDM/Policy + com.microsoft/10.0/MDM/Policy @@ -19578,6 +19630,99 @@ Related policy: + + Properties + + + + + + + Properties of Win32 App ADMX Ingestion + + + + + + + + + + + + + + + * + + + + + + + Setting Type of Win32 App. Policy Or Preference + + + + + + + + + + + + + + + * + + + + + + + Unique ID of ADMX file + + + + + + + + + + + + + + + Version + + + + + + + + Version of ADMX file + + + + + + + + + + + + + + + + + * @@ -19607,6 +19752,7 @@ Related policy: + Unique ID of ADMX file @@ -20165,6 +20311,30 @@ Related policy: + + BlockNonAdminUserInstall + + + + + + + + + + + + + + + + + + + text/plain + + + DisableStoreOriginatedApps @@ -21098,6 +21268,1785 @@ Related policy: + + Audit + + + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + + + + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + + + + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + + + + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditAccountLockout + + + + + + + + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditGroupMembership + + + + + + + + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + + + + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogoff + + + + + + + + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditLogon + + + + + + + + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + + + + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + + + + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + + + + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + + + + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditApplicationGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditComputerAccountManagement + + + + + + + + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditDistributionGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + + + + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditSecurityGroupManagement + + + + + + + + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + + + AccountManagement_AuditUserAccountManagement + + + + + + + + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditDPAPIActivity + + + + + + + + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditPNPActivity + + + + + + + + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessCreation + + + + + + + + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditProcessTermination + + + + + + + + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditRPCEvents + + + + + + + + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + + + + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceAccess + + + + + + + + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceChanges + + + + + + + + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + + + DSAccess_AuditDirectoryServiceReplication + + + + + + + + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditApplicationGenerated + + + + + + + + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + + + + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditCertificationServices + + + + + + + + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditDetailedFileShare + + + + + + + + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileShare + + + + + + + + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFileSystem + + + + + + + + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + + + + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + + + + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditHandleManipulation + + + + + + + + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditKernelObject + + + + + + + + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + + + + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRegistry + + + + + + + + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditRemovableStorage + + + + + + + + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + + + ObjectAccess_AuditSAM + + + + + + + + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + + + + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + + + + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + + + PolicyChange_AuditPolicyChange + + + + + + + + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + + + + Not used. + + + + + + + + + + + text/plain + + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + + + + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + + + System_AuditIPsecDriver + + + + + + + + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + + + System_AuditOtherSystemEvents + + + + + + + + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + + + System_AuditSecurityStateChange + + + + + + + + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + + + System_AuditSecuritySystemExtension + + + + + + + + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + + + System_AuditSystemIntegrity + + + + + + + + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + + Authentication @@ -21759,6 +23708,30 @@ Related policy: + + SetMinimumEncryptionKeySize + + + + + + + + + + + + + + + + + + + text/plain + + + Browser @@ -23021,7 +24994,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -23032,11 +25005,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -25494,6 +27467,30 @@ Related policy: + + DOCacheHostSource + + + + + + + + + + + + + + + + + + + text/plain + + + DODelayBackgroundDownloadFromHttp @@ -25662,6 +27659,30 @@ Related policy: + + DOMaxBackgroundDownloadBandwidth + + + + + + + + + + + + + + + + + + + text/plain + + + DOMaxCacheAge @@ -25711,31 +27732,7 @@ Related policy: - DOMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxUploadBandwidth + DOMaxForegroundDownloadBandwidth @@ -25950,30 +27947,6 @@ Related policy: - - DOPercentageMaxDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - DOPercentageMaxForegroundBandwidth @@ -26328,6 +28301,30 @@ Related policy: + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + AllowInstallationOfMatchingDeviceSetupClasses @@ -26424,6 +28421,30 @@ Related policy: + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + + + text/plain + + + PreventInstallationOfMatchingDeviceSetupClasses @@ -27888,6 +29909,124 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + + + text/plain + + + + + OEMVersion + + + + + + + + + + + + + + + + + + + text/plain + + + + + UserToSignIn + + + + + + + + + + + + + + + + + + + text/plain + + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + + + text/plain + + + + FileExplorer @@ -28767,30 +30906,6 @@ If you do not configure this policy setting, users will be able to choose whethe - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - - - text/plain - - - DisableAdobeFlash @@ -37961,6 +40076,102 @@ If the user has configured a slide show to run on the lock screen when the machi + + LetAppsAccessBackgroundSpatialPerception + + + + + + + + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + + LetAppsAccessCalendar @@ -44048,6 +46259,90 @@ If you disable or do not configure this policy setting, File History can be acti + + ConfigureJapaneseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureSimplifiedChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + + + ConfigureTraditionalChineseIMEVersion + + + + + + + + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -45857,6 +48152,30 @@ If you disable or do not configure this policy setting, the wake setting as spec + + TargetReleaseVersion + + + + + + + + + + + + + + + + + + + text/plain + + + UpdateNotificationLevel @@ -48510,6 +50829,33 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + BlockNonAdminUserInstall + + + + + 0 + + + + + + + + + + + + text/plain + + + AppxPackageManager.admx + AppxPackageManager~AT~WindowsComponents~AppxDeployment + BlockNonAdminUserInstall + LowestValueMostSecure + + DisableStoreOriginatedApps @@ -49577,6 +51923,1960 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi + + Audit + + + + + + + + + + + + + + + + + + + AccountLogon_AuditCredentialValidation + + + + + 0 + This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Credential Validation + LastWrite + + + + AccountLogon_AuditKerberosAuthenticationService + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Authentication Service + LastWrite + + + + AccountLogon_AuditKerberosServiceTicketOperations + + + + + 0 + This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Kerberos Service Ticket Operations + LastWrite + + + + AccountLogon_AuditOtherAccountLogonEvents + + + + + 0 + This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon + Audit Other Account Logon Events + LastWrite + + + + AccountLogonLogoff_AuditAccountLockout + + + + + 1 + This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Account Lockout + LastWrite + + + + AccountLogonLogoff_AuditGroupMembership + + + + + 0 + This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Group Membership + LastWrite + + + + AccountLogonLogoff_AuditIPsecExtendedMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Extended Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecMainMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Main Mode + LastWrite + + + + AccountLogonLogoff_AuditIPsecQuickMode + + + + + 0 + This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If + you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit IPsec Quick Mode + LastWrite + + + + AccountLogonLogoff_AuditLogoff + + + + + 1 + This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logoff + LastWrite + + + + AccountLogonLogoff_AuditLogon + + + + + 1 + This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: + Successful logon attempts. + Failed logon attempts. + Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. + Security identifiers (SIDs) were filtered and not allowed to log on. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Logon + LastWrite + + + + AccountLogonLogoff_AuditNetworkPolicyServer + + + + + 3 + This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Network Policy Server + LastWrite + + + + AccountLogonLogoff_AuditOtherLogonLogoffEvents + + + + + 0 + This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: + Terminal Services session disconnections. + New Terminal Services sessions. + Locking and unlocking a workstation. + Invoking a screen saver. + Dismissal of a screen saver. + Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. + Access to a wireless network granted to a user or computer account. + Access to a wired 802.1x network granted to a user or computer account. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Other Logon Logoff Events + LastWrite + + + + AccountLogonLogoff_AuditSpecialLogon + + + + + 1 + This policy setting allows you to audit events generated by special logons such as the following : + The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. + A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit Special Logon + LastWrite + + + + AccountLogonLogoff_AuditUserDeviceClaims + + + + + 0 + This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff + Audit User Device Claims + LastWrite + + + + AccountManagement_AuditApplicationGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to application groups such as the following: + Application group is created, changed, or deleted. + Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Application Group Management + LastWrite + + + + AccountManagement_AuditComputerAccountManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Computer Account Management + LastWrite + + + + AccountManagement_AuditDistributionGroupManagement + + + + + 0 + This policy setting allows you to audit events generated by changes to distribution groups such as the following: + Distribution group is created, changed, or deleted. + Member is added or removed from a distribution group. + Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +Note: Events in this subcategory are logged only on domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Distributio Group Management + LastWrite + + + + AccountManagement_AuditOtherAccountManagementEvents + + + + + 0 + This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: + The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. + The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. + Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Other Account Management Events + LastWrite + + + + AccountManagement_AuditSecurityGroupManagement + + + + + 1 + This policy setting allows you to audit events generated by changes to security groups such as the following: + Security group is created, changed, or deleted. + Member is added or removed from a security group. + Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit Security Group Management + LastWrite + + + + AccountManagement_AuditUserAccountManagement + + + + + 1 + This policy setting allows you to audit changes to user accounts. Events include the following: + A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. + A user account’s password is set or changed. + A security identifier (SID) is added to the SID History of a user account. + The Directory Services Restore Mode password is configured. + Permissions on administrative user accounts are changed. + Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management + Audit User Account Management + LastWrite + + + + DetailedTracking_AuditDPAPIActivity + + + + + 0 + This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit DPAPI Activity + LastWrite + + + + DetailedTracking_AuditPNPActivity + + + + + 0 + This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit PNP Activity + LastWrite + + + + DetailedTracking_AuditProcessCreation + + + + + 0 + This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Creation + LastWrite + + + + DetailedTracking_AuditProcessTermination + + + + + 0 + This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Process Termination + LastWrite + + + + DetailedTracking_AuditRPCEvents + + + + + 0 + This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit RPC Events + LastWrite + + + + DetailedTracking_AuditTokenRightAdjusted + + + + + 0 + This policy setting allows you to audit events generated by adjusting the privileges of a token. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking + Audit Token Right Adjusted + LastWrite + + + + DSAccess_AuditDetailedDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Detailed Directory Service Replication + LastWrite + + + + DSAccess_AuditDirectoryServiceAccess + + + + + 0 + This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Access + LastWrite + + + + DSAccess_AuditDirectoryServiceChanges + + + + + 0 + This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Changes + LastWrite + + + + DSAccess_AuditDirectoryServiceReplication + + + + + 0 + This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access + Audit Directory Service Replication + LastWrite + + + + ObjectAccess_AuditApplicationGenerated + + + + + 0 + This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: + Creation of an application client context. + Deletion of an application client context. + Initialization of an application client context. + Other application operations using the Windows Auditing APIs. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Application Generated + LastWrite + + + + ObjectAccess_AuditCentralAccessPolicyStaging + + + + + 0 + This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2) Failure audits when configured records access attempts when: + a) The current central access policy does not grant access but the proposed policy grants access. + b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Central Access Policy Staging + LastWrite + + + + ObjectAccess_AuditCertificationServices + + + + + 0 + This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + AD CS startup/shutdown/backup/restore. + Changes to the certificate revocation list (CRL). + New certificate requests. + Issuing of a certificate. + Revocation of a certificate. + Changes to the Certificate Manager settings for AD CS. + Changes in the configuration of AD CS. + Changes to a Certificate Services template. + Importing of a certificate. + Publishing of a certification authority certificate is to Active Directory Domain Services. + Changes to the security permissions for AD CS. + Archival of a key. + Importing of a key. + Retrieval of a key. + Starting of Online Certificate Status Protocol (OCSP) Responder Service. + Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Certification Services + LastWrite + + + + ObjectAccess_AuditDetailedFileShare + + + + + 0 + This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Detailed File Share + LastWrite + + + + ObjectAccess_AuditFileShare + + + + + 0 + This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File Share + LastWrite + + + + ObjectAccess_AuditFileSystem + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit File System + LastWrite + + + + ObjectAccess_AuditFilteringPlatformConnection + + + + + 0 + This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: + The Windows Firewall Service blocks an application from accepting incoming connections on the network. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits a bind to a local port. + The WFP blocks a bind to a local port. + The WFP allows a connection. + The WFP blocks a connection. + The WFP permits an application or service to listen on a port for incoming connections. + The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Connection + LastWrite + + + + ObjectAccess_AuditFilteringPlatformPacketDrop + + + + + 0 + This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Filtering Platform Packet Drop + LastWrite + + + + ObjectAccess_AuditHandleManipulation + + + + + 0 + This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Handle Manipulation + LastWrite + + + + ObjectAccess_AuditKernelObject + + + + + 0 + This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Kernel Object + LastWrite + + + + ObjectAccess_AuditOtherObjectAccessEvents + + + + + 0 + This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: + Job created. + Job deleted. + Job enabled. + Job disabled. + Job updated. +For COM+ objects, the following are audited: + Catalog object added. + Catalog object updated. + Catalog object deleted. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Other Object Access Events + LastWrite + + + + ObjectAccess_AuditRegistry + + + + + 0 + This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +Note: You can set a SACL on a registry object using the Permissions dialog box. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Registry + LastWrite + + + + ObjectAccess_AuditRemovableStorage + + + + + 0 + This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit Removable Storage + LastWrite + + + + ObjectAccess_AuditSAM + + + + + 0 + This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: + SAM_ALIAS -- A local group. + SAM_GROUP -- A group that is not a local group. + SAM_USER – A user account. + SAM_DOMAIN – A domain. + SAM_SERVER – A computer account. +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. +Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access + Audit SAM + LastWrite + + + + PolicyChange_AuditAuthenticationPolicyChange + + + + + 1 + This policy setting allows you to audit events generated by changes to the authentication policy such as the following: + Creation of forest and domain trusts. + Modification of forest and domain trusts. + Removal of forest and domain trusts. + Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. + Granting of any of the following user rights to a user or group: + Access This Computer From the Network. + Allow Logon Locally. + Allow Logon Through Terminal Services. + Logon as a Batch Job. + Logon a Service. + Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authentication Policy Change + LastWrite + + + + PolicyChange_AuditAuthorizationPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the authorization policy such as the following: + Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. + Changes in the Encrypted File System (EFS) policy. + Changes to the Resource attributes of an object. + Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Authorization Policy Change + LastWrite + + + + PolicyChange_AuditFilteringPlatformPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: + IPsec services status. + Changes to IPsec policy settings. + Changes to Windows Firewall policy settings. + Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Filtering Platform Policy Change + LastWrite + + + + PolicyChange_AuditMPSSVCRuleLevelPolicyChange + + + + + 0 + This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: + Reporting of active policies when Windows Firewall service starts. + Changes to Windows Firewall rules. + Changes to Windows Firewall exception list. + Changes to Windows Firewall settings. + Rules ignored or not applied by Windows Firewall Service. + Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit MPSSVC Rule Level Policy Change + LastWrite + + + + PolicyChange_AuditOtherPolicyChangeEvents + + + + + 0 + This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: + Trusted Platform Module (TPM) configuration changes. + Kernel-mode cryptographic self tests. + Cryptographic provider operations. + Cryptographic context operations or modifications. + Applied Central Access Policies (CAPs) changes. + Boot Configuration Data (BCD) modifications. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Other Policy Change Events + LastWrite + + + + PolicyChange_AuditPolicyChange + + + + + 1 + This policy setting allows you to audit changes in the security audit policy settings such as the following: + Settings permissions and audit settings on the Audit Policy object. + Changes to the system audit policy. + Registration of security event sources. + De-registration of security event sources. + Changes to the per-user audit settings. + Changes to the value of CrashOnAuditFail. + Changes to the system access control list on a file system or registry object. + Changes to the Special Groups list. + +Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change + Audit Policy Change + LastWrite + + + + PrivilegeUse_AuditNonSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: + Access Credential Manager as a trusted caller. + Access this computer from the network. + Add workstations to domain. + Adjust memory quotas for a process. + Allow log on locally. + Allow log on through Terminal Services. + Bypass traverse checking. + Change the system time. + Create a pagefile. + Create global objects. + + Create permanent shared objects. + Create symbolic links. + Deny access this computer from the network. + Deny log on as a batch job. + Deny log on as a service. + Deny log on locally. + Deny log on through Terminal Services. + Force shutdown from a remote system. + Increase a process working set. + Increase scheduling priority. + Lock pages in memory. + Log on as a batch job. + Log on as a service. + Modify an object label. + Perform volume maintenance tasks. + Profile single process. + Profile system performance. + Remove computer from docking station. + Shut down the system. + Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Non Sensitive Privilege Use + LastWrite + + + + PrivilegeUse_AuditOtherPrivilegeUseEvents + + + + + 0 + Not used. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Other Privilege Use Events + LastWrite + + + + PrivilegeUse_AuditSensitivePrivilegeUse + + + + + 0 + This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: + A privileged service is called. + One of the following privileges are called: + Act as part of the operating system. + Back up files and directories. + Create a token object. + Debug programs. + Enable computer and user accounts to be trusted for delegation. + Generate security audits. + Impersonate a client after authentication. + Load and unload device drivers. + Manage auditing and security log. + Modify firmware environment values. + Replace a process-level token. + Restore files and directories. + Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use + Audit Sensitive Privilege Use + LastWrite + + + + System_AuditIPsecDriver + + + + + 0 + This policy setting allows you to audit events generated by the IPsec filter driver such as the following: + Startup and shutdown of the IPsec services. + Network packets dropped due to integrity check failure. + Network packets dropped due to replay check failure. + Network packets dropped due to being in plaintext. + Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. + Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit IPsec Driver + LastWrite + + + + System_AuditOtherSystemEvents + + + + + 3 + This policy setting allows you to audit any of the following events: + Startup and shutdown of the Windows Firewall service and driver. + Security policy processing by the Windows Firewall Service. + Cryptography key file and migration operations. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Other System Events + LastWrite + + + + System_AuditSecurityStateChange + + + + + 1 + This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: + Startup and shutdown of the computer. + Change of system time. + Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security State Change + LastWrite + + + + System_AuditSecuritySystemExtension + + + + + 0 + This policy setting allows you to audit events related to security system extensions or services such as the following: + A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. + A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit Security System Extension + LastWrite + + + + System_AuditSystemIntegrity + + + + + 3 + This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: + Events that could not be written to the event log because of a problem with the auditing system. + A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. + The detection of a Remote Procedure Call (RPC) that compromises system integrity. + The detection of a hash value of an executable file that is not valid as determined by Code Integrity. + Cryptographic operations that compromise system integrity. + + + + + + + + + + + text/plain + + + phone + Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System + Audit System Integrity + LastWrite + + + Authentication @@ -50264,6 +54564,30 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi LastWrite + + SetMinimumEncryptionKeySize + + + + + 0 + + + + + + + + + + + + text/plain + + + LastWrite + + Browser @@ -51675,7 +55999,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -51686,11 +56010,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -54424,6 +58748,34 @@ Related policy: LastWrite + + DOCacheHostSource + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + CacheHostSource + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + CacheHostSource + LastWrite + + DODelayBackgroundDownloadFromHttp @@ -54619,6 +58971,34 @@ Related policy: LastWrite + + DOMaxBackgroundDownloadBandwidth + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + MaxBackgroundDownloadBandwidth + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + MaxBackgroundDownloadBandwidth + LastWrite + + DOMaxCacheAge @@ -54676,7 +59056,7 @@ Related policy: - DOMaxDownloadBandwidth + DOMaxForegroundDownloadBandwidth @@ -54697,37 +59077,9 @@ Related policy: DeliveryOptimization.admx - MaxDownloadBandwidth + MaxForegroundDownloadBandwidth DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxDownloadBandwidth - LastWrite - - - - DOMaxUploadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxUploadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxUploadBandwidth + MaxForegroundDownloadBandwidth LastWrite @@ -54954,35 +59306,6 @@ Related policy: LastWrite - - DOPercentageMaxDownloadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - DeliveryOptimization.admx - PercentageMaxDownloadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - PercentageMaxDownloadBandwidth - LastWrite - - DOPercentageMaxForegroundBandwidth @@ -55429,6 +59752,33 @@ Related policy: LastWrite + + AllowInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Allow + LastWrite + + AllowInstallationOfMatchingDeviceSetupClasses @@ -55537,6 +59887,33 @@ Related policy: LastWrite + + PreventInstallationOfMatchingDeviceInstanceIDs + + + + + + + + + + + + + + + + + text/plain + + phone + deviceinstallation.admx + DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category + DeviceInstall_Instance_IDs_Deny + LastWrite + + PreventInstallationOfMatchingDeviceSetupClasses @@ -57087,6 +61464,118 @@ If you do not configure this policy setting, users will be able to choose whethe + + FactoryComposer + + + + + + + + + + + + + + + + + + + BackgroundImagePath + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + OEMVersion + + + + + unset; partners can set via settings customization! + + + + + + + + + + + + text/plain + + LastWrite + + + + UserToSignIn + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + + UWPLaunchOnBoot + + + + + + + + + + + + + + + + + text/plain + + LastWrite + + + FileExplorer @@ -58055,33 +62544,6 @@ If you do not configure this policy setting, users will be able to choose whethe LastWrite - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VersionListAutomaticDownloadDisable - LastWrite - - DisableAdobeFlash @@ -68232,6 +72694,102 @@ If the user has configured a slide show to run on the lock screen when the machi ; + + LetAppsAccessBackgroundSpatialPerception + + + + + 0 + This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + + + + + + + + + + + text/plain + + + HighestValueMostSecure + + + + LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + + + LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps + + + + + + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + + + + + + + + + + + text/plain + + LastWrite + ; + + LetAppsAccessCalendar @@ -74951,6 +79509,99 @@ If you disable or do not configure this policy setting, File History can be acti LowestValueMostSecure + + ConfigureJapaneseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. +1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. +2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureJapaneseImeVersion + LowestValueMostSecure + + + + ConfigureSimplifiedChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. +1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. +2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureSimplifiedChineseImeVersion + LowestValueMostSecure + + + + ConfigureTraditionalChineseIMEVersion + + + + + 0 + This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. +The following list shows the supported values: +0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. +1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. +2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. + + + + + + + + + + + text/plain + + + EAIME.admx + EAIME~AT~WindowsComponents~L_IME + L_ConfigureTraditionalChineseImeVersion + LowestValueMostSecure + + EnableTouchKeyboardAutoInvokeInDesktopMode @@ -76956,6 +81607,33 @@ If you disable or do not configure this policy setting, the wake setting as spec LastWrite + + TargetReleaseVersion + + + + + + + + + + + + + + + + + text/plain + + WindowsUpdate.admx + TargetReleaseVersionId + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat + TargetReleaseVersion + LastWrite + + UpdateNotificationLevel diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index e2b10b625a..2c1db8dd46 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -9,14 +9,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 07/20/2018 +ms.date: 06/03/2020 --- # SUPL DDF file -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider (CSP). Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 5556b97262..667776a7f8 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -110,10 +110,10 @@ To verify the BCD entries: >[!NOTE] >This output may not contain a path. -2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. +2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device**, **path**, **osdevice**, and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. > [!NOTE] - > If the computer is UEFI-based, the **bootmgr** and **winload** entries under **{default}** will contain an **.efi** extension. + > If the computer is UEFI-based, the filepath value specified in the **path** parameter of **{bootmgr}** and **{default}** will contain an **.efi** extension. ![bcdedit](images/screenshot1.png) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 7c8dff22d6..bb8692ebf4 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -126,7 +126,7 @@ - name: Deploy updates with Configuration Manager href: update/deploy-updates-configmgr.md - name: Deploy updates with Intune - href: update/waas-wufb-csp-mdm.md + href: update/deploy-updates-intune.md - name: Deploy updates with WSUS href: update/waas-manage-updates-wsus.md - name: Deploy updates with Group Policy @@ -245,6 +245,8 @@ - name: Delivery Optimization reference href: update/waas-delivery-optimization-reference.md - name: Windows 10 in S mode + href: s-mode.md + - name: Switch to Windows 10 Pro or Enterprise from S mode href: windows-10-pro-in-s-mode.md - name: Windows 10 deployment tools items: diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 753f83e575..3827964e67 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -22,29 +22,35 @@ landingContent: # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) - - title: Overview + - title: Deploy Windows 10 linkLists: - linkListType: overview links: - text: Windows 10 deployment scenarios url: windows-10-deployment-scenarios.md - - text: What is Windows as a service? - url: update/waas-overview.md - - text: Types of Windows updates - url: update/waas-quick-start.md#definitions - # Card (optional) - - title: Get started - linkLists: - linkListType: get-started links: - text: Demonstrate Autopilot deployment url: windows-autopilot/demonstrate-deployment-on-vm.md - - text: Servicing the Windows 10 operating system - url: update/waas-servicing-strategy-windows-10-updates.md - text: Deploy Windows 10 in a test lab url: windows-10-poc.md + # Card (optional) + - title: Update Windows 10 + linkLists: + - linkListType: overview + links: + - text: What is Windows as a service? + url: update/waas-overview.md + - text: Types of Windows updates + url: update/waas-quick-start.md#definitions + - linkListType: get-started + links: + - text: Servicing the Windows 10 operating system + url: update/waas-servicing-strategy-windows-10-updates.md + + # Card (optional) - title: Deployment planning linkLists: @@ -52,8 +58,12 @@ landingContent: links: - text: Create a deployment plan url: update/create-deployment-plan.md + - text: Define readiness criteria + url: update/plan-define-readiness.md - text: Evaluate infrastructure and tools url: update/eval-infra-tools.md + - text: Determine application readiness + url: update/plan-determine-app-readiness.md - text: Define your servicing strategy url: update/waas-servicing-strategy-windows-10-updates.md @@ -62,7 +72,9 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Prepare to deploy Windows 10 + - text: Prepare for Zero Touch Installation with Configuration Manager + url: deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md + - text: Prepare to deploy Windows 10 with MDT url: deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md - text: Evaluate and update infrastructure url: update/update-policies.md @@ -70,25 +82,34 @@ landingContent: url: update/waas-deployment-rings-windows-10-updates.md # Card - - title: Deploy Windows 10 + - title: Deploy and update Windows 10 linkLists: - linkListType: deploy links: - - text: Deploy Windows 10 with Autopilot + - text: Windows Autopilot scenarios and capabilities url: windows-autopilot/windows-autopilot-scenarios.md + - text: Deploy Windows 10 to a new device with Configuration Manager + url: deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md + - text: Deploy a Windows 10 image using MDT + url: deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md - text: Assign devices to servicing channels url: update/waas-servicing-channels-windows-10-updates.md - text: Deploy Windows 10 updates - url: update/index.md + url: update/waas-servicing-channels-windows-10-updates.md + - text: Resolve Windows 10 upgrade errors + url: upgrade/resolve-windows-10-upgrade-errors.md # Card (optional) - - title: Also see + - title: Windows 10 resources linkLists: - - linkListType: reference + - linkListType: learn links: - text: Windows 10 release information - url: https://docs.microsoft.com/en-us/windows/release-information/ + url: https://docs.microsoft.com/windows/release-information/ - text: What's new in Windows 10 - url: https://docs.microsoft.com/en-us/windows/whats-new/ + url: https://docs.microsoft.com/windows/whats-new/ - text: Windows 10 Enterprise Security - url: https://docs.microsoft.com/en-us/windows/security/ + url: https://docs.microsoft.com/windows/security/ + - text: Desktop Deployment Center + url: https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home + diff --git a/windows/deployment/update/plan-determine-app-readiness.md b/windows/deployment/update/plan-determine-app-readiness.md index 29c3c93099..b7e1707a7d 100644 --- a/windows/deployment/update/plan-determine-app-readiness.md +++ b/windows/deployment/update/plan-determine-app-readiness.md @@ -43,7 +43,7 @@ Combining the various validation methods with the app classifications you've pre |Test in pilot | x | x | x | -## Identify users +### Identify users Since your organization no doubt has a wide variety of users, each with different background and regular tasks, you'll have to choose which users are best suited for validation testing. Some factors to consider include: @@ -53,7 +53,7 @@ Since your organization no doubt has a wide variety of users, each with differen You could seek volunteers who enjoy working with new features and include them in the pilot deployment. You might want to avoid using core users like department heads or project managers. Current application owners, operations personnel, and developers can help you identify the most appropriate pilot users. -## Identify and set up devices for validation +### Identify and set up devices for validation In addition to users, it's important to carefully choose devices to participate in app validation as well. For example, ideally, your selection will include devices representing all of the hardware models in your environment. @@ -64,7 +64,7 @@ There is more than one way to choose devices for app validation: - **Data-driven analysis**: With appropriate tools, you can use diagnostic data from devices to inform your choices. -## Desktop Analytics +### Desktop Analytics Desktop Analytics can make all of the tasks discussed in this article significantly easier: diff --git a/windows/deployment/update/prepare-deploy-windows.md b/windows/deployment/update/prepare-deploy-windows.md new file mode 100644 index 0000000000..76cbb5eea0 --- /dev/null +++ b/windows/deployment/update/prepare-deploy-windows.md @@ -0,0 +1,158 @@ +--- +title: Prepare to deploy Windows +description: +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Prepare to deploy Windows + +Having worked through the activities in the planning phase, you should be in a good position to prepare your environment and process to deploy Windows 10. The planning phase will have left you with these useful items: + +- A clear understanding of necessary personnel and their roles and criteria for [rating app readiness](plan-define-readiness.md) +- A plan for [testing and validating](plan-determine-app-readiness.md) apps +- An assessment of your [deployment infrastructure](eval-infra-tools.md) and definitions for operational readiness +- A [deployment plan](create-deployment-plan.md) that defines the rings you want to use + +Now you're ready to actually start making changes in your environment to get ready to deploy. + +## Prepare infrastructure and environment + +- Deploy site server updates for Configuration Manager. +- Update non-Microsoft security tools like security agents or servers. +- Update non-Microsoft management tools like data loss prevention agents. + +Your infrastructure probably includes many different components and tools. You’ll need to ensure your environment isn’t affected by issues due to the changes you make to the various parts of the infrastructure. Follow these steps: + +1. Review all of the infrastructure changes that you’ve identified in your plan. It’s important to understand the changes that need to be made and to detail how to implement them. This prevents problems later on. +2. Validate your changes. You’ll validate the changes for your infrastructure’s components and tools, to help you understand how your changes could affect your production environment. +3. Implement the changes. Once the changes have been validated, you can implement the changes across the wider infrastructure. + + +You should also look at your organization’s environment’s configuration and outline how you’ll implement any necessary changes previously identified in the plan phase to support the update. Consider what you’ll need to do for the various settings and policies that currently underpin the environment. For example: + +- Implement new draft security guidance. New versions of Windows can include new features that improve your environment’s security. Your security teams will want to make appropriate changes to security related configurations. +- Update security baselines. Security teams understand the relevant security baselines and will have to work to make sure all baselines fit into whatever guidance they have to adhere to. +However, your configuration will consist of many different settings and policies. It’s important to only apply changes where they are necessary, and where you gain a clear improvement. Otherwise, your environment might face issues that will slow down the update process. You want to ensure your environment isn’t affected adversely because of changes you make. For example: + +1. Review new security settings. Your security team will review the new security settings, to understand how they can best be set to facilitate the update, and to also investigate the potential effects they might have on your environment. +2. Review security baselines for changes. Security teams will also review all the necessary security baselines, to ensure the changes can be implemented, and ensure your environment remains compliant. +3. Implement and validate security settings and baseline changes. Your security teams will then implement all of the security settings and baselines, having addressed any potential outstanding issues. + + +## Prepare applications and devices + +You've previously decided on which validation methods you want to use to validate apps in the upcoming pilot deployment phase. Now is a good time to make sure that individual devices are ready and able to install the next update without difficulty. + +### Ensure updates are available + +Enable update services on devices. Ensure that every device is running all the services Windows Update relies on. Sometimes users or even malware can disable the services Windows Update requires to work correctly. Make sure the following services are running: + +- Background Intelligent Transfer Service +- Background Tasks Infrastructure Service +- BranchCache (if you use this feature for update deployment) +- ConfigMgr Task Sequence Agent (if you use Configuration Manager to deploy updates) +- Cryptographic Services +- DCOM Server Process Launcher +- Device Install +- Delivery Optimization +- Device Setup Manager +- License Manager +- Microsoft Account Sign-in Assistant +- Microsoft Software Shadow Copy Provider +- Remote Procedure Call (RPC) +- Remote Procedure Call (RPC) Locator +- RPC Endpoint Mapper +- Service Control Manager +- Task Scheduler +- Token Broker +- Update Orchestrator Service +- Volume Shadow Copy Service +- Windows Automatic Update Service +- Windows Backup +- Windows Defender Firewall +- Windows Management Instrumentation +- Windows Management Service +- Windows Module Installer +- Windows Push Notification +- Windows Security Center Service +- Windows Time Service +- Windows Update +- Windows Update Medic Service + +You can check these services manually by using Services.msc, or by using PowerShell scripts, Desktop Analytics, or other methods. + +### Network configuration + +Ensure that devices can reach necessary Windows Update endpoints through the firewall. + +### Optimize download bandwidth +Set up [Delivery Optimization](waas-delivery-optimization.md) for peer network sharing or Microsoft Connected Cache. + +### Address unhealthy devices + +In the course of surveying your device population, either with Desktop Analytics or by some other means, you might find devices that have systemic problems that could interfere with update installation. Now is the time to fix those problems. + +- **Low disk space:** Quality updates require a minimum of two GB to successfully install. Feature updates require between 8 and 15 GB depending upon the configuration. On Windows 10, version 1903 and later you can proactively use the "reserved storage" feature (for wipe and loads, rebuilds, and new builds) to avoid running out of disk space. If you find a group of devices that don't have enough disk space, you can often resolve this by cleaning up log files and asking users to clean up data if necessary. A good place to start is to delete the following files: +- C:\Windows\temp +- C:\Windows\cbstemp (though this file might be necessary to investigate update failures) +- C:\Windows\WindowsUpdate.log (though this file might be necessary to investigate update failures) +- C:\Windows.Old (these files should automatically clean up after 10 days or might ask the device user for permission to clean up sooner when constrained for disk space) + +You can also create and run scripts to perform additional cleanup actions on devices, with administrative rights, or use Group Policy settings. + +- Clean up the Windows Store Cache by running C:\Windows\sytem32\wsreset.exe +- Optimize the WinSxS folder on the client machine by using **Dism.exe /online /Cleanup-Image /StartComponentCleanup** +- Compact the operating system by running **Compact.exe /CompactOS:always** +- Remove Windows Features on Demand that the user doesn't need. See [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) for more guidance. +- Move Windows Known Folders to OneDrive. See [Use Group Policy to control OneDrive sync settings](https://docs.microsoft.com/onedrive/use-group-policy) for more information. +- Clean up the Software Distribution folder. Try deploying these commands as a batch file to run on devices to reset the download state of Windows Updates: + +``` +net stop wuauserv +net stop cryptSvc +net stop bits +net stop msiserver +ren C:\Windows\SoftwareDistribution C:\Windows\SoftwareDistribution.old +net start wuauserv +net start cryptSvc +net start bits +net start msiserver +``` + +- **Application and driver updates:** Out-of-date app or driver software can prevent devices from updating successfully. Desktop Analytics will help you identify drivers and applications that need attention. You can also +check for known issues in order to take any appropriate action. Deploy any updates from the vendor(s) for any problematic application or driver versions to resolve issues. +- **Corruption:** In rare circumstances, a device that has repeated installation errors might be corrupted in a way that prevents the system from applying a new update. You might have to repair the Component Based Store from another source. You can do this with the [System File Checker](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). + + + + + +## Prepare capability + +In the plan phase, you determined the specific infrastructure and configuration changes that needed to be implemented to add new capabilities to the environment. Now you can move on to implementing those changes defined in the plan phase. You'll need to complete these higher-level tasks to gain those new capabilities: + +- Enable capabilities across the environment by implementing the changes. For example, implement updates to relevant ADMX templates in Active Directory. New Windows versions will come with new policies that you use to update ADMX templates. +- Validate new changes to understand how they affect the wider environment. +- Remediate any potential problems that have been identified through validation. + +## Prepare users + +Users often feel like they are forced into updating their devices randomly. They often don't fully understand why an update is needed, and they don't know when updates would be applied to their devices ahead of time. It's best to ensure that upcoming updates are communicated clearly and with adequate warning. + +You can employ a variety of measures to achieve this, for example: + +- Send overview email about the update and how it will be deployed to the entire organization. +- Send personalized emails to users about the update with specific details. +- Set an opt-out deadline for employees that need to remain on the current version for a bit longer, due to a business need. +- Provide the ability to voluntarily update at users’ convenience. +- Inform users of a mandatory installation date when the update will be installed on all devices. + + diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 8e4da6a05c..311272e93b 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -1,5 +1,5 @@ --- -title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10) +title: Monitor Windows Updates and Microsoft Defender AV with Update Compliance (Windows 10) ms.reviewer: manager: laurawi description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network. diff --git a/windows/deployment/windows-autopilot/autopilot-faq.md b/windows/deployment/windows-autopilot/autopilot-faq.md index 616f6b21ce..1cbfeeb11b 100644 --- a/windows/deployment/windows-autopilot/autopilot-faq.md +++ b/windows/deployment/windows-autopilot/autopilot-faq.md @@ -144,6 +144,7 @@ A [glossary](#glossary) of abbreviations used in this article is provided at the | What are some common causes of registration failures? |1. Bad or missing hardware hash entries can lead to faulty registration attempts
2. Hidden special characters in CSV files.

To avoid this issue, after creating your CSV file, open it in Notepad to look for hidden characters or trailing spaces or other corruptions.| | Is Autopilot supported on IoT devices? | Autopilot is not supported on IoT Core devices, and there are currently no plans to add this support. Autopilot is supported on Windows 10 IoT Enterprise SAC devices. Autopilot is supported on Windows 10 Enterprise LTSC 2019 and above; it is not supported on earlier versions of LTSC.| | Is Autopilot supported in all regions/countries? | Autopilot only supports customers using global Azure. Global Azure does not include the three entities listed below:
- Azure Germany
- Azure China 21Vianet
- Azure Government
So, if a customer is set up in global Azure, there are no region restrictions. For example, if Contoso uses global Azure but has employees working in China, the Contoso employees working in China would be able to use Autopilot to deploy devices. If Contoso uses Azure China 21Vianet, the Contoso employees would not be able to use Autopilot.| +| I need to register a device that's been previously registered to another organisation. | Partners registering devices through partner center can also deregister the device if it's moving between different customer tenants. If this isn't possible, as a last resort you can raise a ticket through the Intune "Help and Support" node and our support teams will assist you. | ## Glossary diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 6085890428..7d7448f4d5 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -14,7 +14,7 @@ ms.author: obezeajo manager: robsize ms.collection: M365-security-compliance ms.topic: article -ms.date: 5/14/2020 +ms.date: 6/3/2020 --- # Manage connections from Windows 10 operating system components to Microsoft services @@ -37,7 +37,9 @@ Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline] > - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. > [!Warning] -> If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> - If a user executes the **Reset this PC** command (Settings -> Update & Security -> Recovery) with the **Keep my files option** (or the **Remove Everything** option) the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied in order to re-restrict the device. Egress traffic may occur prior to the re-application of the Restricted Traffic Limited Functionality Baseline settings. +> - To restrict a device effectively (first time or subsequently), it is recommended to apply the Restricted Traffic Limited Functionality Baseline settings package in offline mode. +> - During update or upgrade of Windows, egress traffic may occur. To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) @@ -550,7 +552,7 @@ To disable the Microsoft Account Sign-In Assistant: ### 13. Microsoft Edge -Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682). +Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682) and [Configure Microsoft Edge policy settings on Windows](https://docs.microsoft.com/DeployEdge/configure-microsoft-edge). ### 13.1 Microsoft Edge Group Policies diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index f42095fd31..a51e3b166f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -75,8 +75,9 @@ Sign-in the federation server with domain administrator equivalent credentials. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. -9. Click **Enroll**. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. +9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. +10. Click **Enroll**. A server authentication certificate should appear in the computer’s Personal certificate store. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 067d2d3504..3fc4c88711 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -150,7 +150,7 @@ Domain controllers automatically request a certificate from the domain controlle 7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. 8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. 9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box. 11. Select the **Update certificates that use certificate templates** check box. 12. Click **OK**. Close the **Group Policy Management Editor**. diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md index 311c43f82b..74c19eb50f 100644 --- a/windows/security/threat-protection/intelligence/criteria.md +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -175,7 +175,7 @@ Microsoft uses specific categories and the category definitions to classify soft * **Cryptomining software:** Software that uses your device resources to mine cryptocurrencies. -* **Bundling software:** Software that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualifies as PUA based on the criteria outlined in this document. +* **Bundling software:** Software that offers to install other software that is not developed by the same entity or not required for the software to run. Also, software that offers to install other software that qualifies as PUA based on the criteria outlined in this document. * **Marketing software:** Software that monitors and transmits the activities of users to applications or services other than itself for marketing research. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md index 532462188a..691027c34e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data-update-compliance.md @@ -1,7 +1,7 @@ --- title: Collect diagnostic data for Update Compliance and Windows Defender Microsoft Defender Antivirus description: Use a tool to collect data to troubleshoot Update Compliance issues when using the Microsoft Defender Antivirus Assessment add in -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -17,13 +17,13 @@ ms.reviewer: manager: dansimp --- -# Collect Update Compliance diagnostic data for Windows Defender AV Assessment +# Collect Update Compliance diagnostic data for Microsoft Defender AV Assessment **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV Assessment section in the Update Compliance add-in. +This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV Assessment section in the Update Compliance add-in. Before attempting this process, ensure you have read [Troubleshoot Microsoft Defender Antivirus reporting](troubleshoot-reporting.md), met all require prerequisites, and taken any other suggested troubleshooting steps. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md index 708ec3f869..6152f332d7 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/collect-diagnostic-data.md @@ -1,7 +1,7 @@ --- title: Collect diagnostic data of Microsoft Defender Antivirus description: Use a tool to collect data to troubleshoot Microsoft Defender Antivirus -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -17,13 +17,13 @@ ms.reviewer: manager: dansimp --- -# Collect Windows Defender AV diagnostic data +# Collect Microsoft Defender AV diagnostic data **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Windows Defender AV. +This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV. On at least two devices that are experiencing the same issue, obtain the .cab diagnostic file by taking the following steps: diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md index a48b41622f..9ca273c668 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Manage Windows Defender in your business -description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Windows Defender AV +description: Learn how to use Group Policy, Configuration Manager, PowerShell, WMI, Intune, and the command line to manage Microsoft Defender AV keywords: group policy, gpo, config manager, sccm, scep, powershell, wmi, intune, defender, antivirus, antimalware, security, protection search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md index e2bba2fe2b..3464a06430 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Configure scanning options for Windows Defender AV -description: You can configure Windows Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). +title: Configure scanning options for Microsoft Defender AV +description: You can configure Microsoft Defender AV to scan email storage files, back-up or reparse points, network files, and archived files (such as .zip files). keywords: advanced scans, scanning, email, archive, zip, rar, archive, reparse scanning search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md index 3906d071de..5fb8feab26 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus.md @@ -34,7 +34,7 @@ You can [specify how long the file should be prevented from running](configure-c When Microsoft Defender Antivirus encounters a suspicious but undetected file, it queries our cloud protection backend. The cloud backend applies heuristics, machine learning, and automated analysis of the file to determine whether the files are malicious or clean. Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Windows Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) In Windows 10, version 1803, block at first sight can now block non-portable executable files (such as JS, VBS, or macros) as well as executable files. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md index 6fb6d97688..7840be58fc 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-cloud-block-timeout-period-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Configure the Windows Defender AV cloud block timeout period +title: Configure the Microsoft Defender AV cloud block timeout period description: You can configure how long Microsoft Defender Antivirus will block a file from running while waiting for a cloud determination. keywords: Microsoft Defender Antivirus, antimalware, security, defender, cloud, timeout, block, period, seconds search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md index 13346bae2f..b7af3e0452 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-end-user-interaction-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Configure how users can interact with Windows Defender AV -description: Configure how end-users interact with Windows Defender AV, what notifications they see, and if they can override settings. +title: Configure how users can interact with Microsoft Defender AV +description: Configure how end-users interact with Microsoft Defender AV, what notifications they see, and if they can override settings. keywords: endpoint, user, interaction, notifications, ui lockdown mode, headless mode, hide interface search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md index 6407947fe2..78dd9f20a7 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Set up exclusions for Windows Defender AV scans -description: You can exclude files (including files modified by specified processes) and folders from being scanned by Windows Defender AV. Validate your exclusions with PowerShell. +title: Set up exclusions for Microsoft Defender AV scans +description: You can exclude files (including files modified by specified processes) and folders from being scanned by Microsoft Defender AV. Validate your exclusions with PowerShell. keywords: search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md index db259755b0..de3333fed1 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus.md @@ -140,7 +140,7 @@ All files under a folder (including files in subdirectories), or a specific file >[!IMPORTANT] >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file with the `.test` file extension: +For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file with the `.test` file extension: ```PowerShell Add-MpPreference -ExclusionExtension ".test" diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md index a7871d1232..16fc08a832 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Configure local overrides for Windows Defender AV settings -description: Enable or disable users from locally changing settings in Windows Defender AV. +title: Configure local overrides for Microsoft Defender AV settings +description: Enable or disable users from locally changing settings in Microsoft Defender AV. keywords: local override, local policy, group policy, gpo, lockdown,merge, lists search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md index 7b14f8eda8..ffe624dd8e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-process-opened-file-exclusions-microsoft-defender-antivirus.md @@ -101,7 +101,7 @@ Remove items from the list | `Remove-MpPreference` >[!IMPORTANT] >If you have created a list, either with `Set-MpPreference` or `Add-MpPreference`, using the `Set-MpPreference` cmdlet again will overwrite the existing list. -For example, the following code snippet would cause Windows Defender AV scans to exclude any file that is opened by the specified process: +For example, the following code snippet would cause Microsoft Defender AV scans to exclude any file that is opened by the specified process: ```PowerShell Add-MpPreference -ExclusionProcess "c:\internal\test.exe" diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md index e09172a74b..2f09169a15 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configure-protection-features-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Enable and configure Microsoft Defender Antivirus protection features -description: Enable behavior-based, heuristic, and real-time protection in Windows Defender AV. +description: Enable behavior-based, heuristic, and real-time protection in Microsoft Defender AV. keywords: heuristic, machine-learning, behavior monitor, real-time protection, always-on, Microsoft Defender Antivirus, antimalware, security, defender search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md index 096a6816cb..a906762b9a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus.md @@ -44,7 +44,7 @@ This guide describes how to configure your VMs for optimal protection and perfor You can also download the whitepaper [Microsoft Defender Antivirus on Virtual Desktop Infrastructure](https://demo.wd.microsoft.com/Content/wdav-testing-vdi-ssu.pdf), which looks at the new shared security intelligence update feature, alongside performance testing and guidance on how you can test antivirus performance on your own VDI. > [!IMPORTANT] -> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
There are performance and feature improvements to the way in which Windows Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. +> Although the VDI can be hosted on Windows Server 2012 or Windows Server 2016, the virtual machines (VMs) should be running Windows 10, 1607 at a minimum, due to increased protection technologies and features that are unavailable in earlier versions of Windows.
There are performance and feature improvements to the way in which Microsoft Defender AV operates on virtual machines in Windows 10 Insider Preview, build 18323 (and later). We'll identify in this guide if you need to be using an Insider Preview build; if it isn't specified, then the minimum required version for the best protection and performance is Windows 10 1607. ### Set up a dedicated VDI file share @@ -194,7 +194,7 @@ If you would prefer to do everything manually, this what you would need to do to Scheduled scans run in addition to [real-time protection and scanning](configure-real-time-protection-microsoft-defender-antivirus.md). -The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Windows Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan. +The start time of the scan itself is still based on the scheduled scan policy – ScheduleDay, ScheduleTime, ScheduleQuickScanTime. Randomization will cause Microsoft Defender AV to start a scan on each machine within a 4 hour window from the time set for the scheduled scan. See [Schedule scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) for other configuration options available for scheduled scans. @@ -219,7 +219,7 @@ Sometimes, Microsoft Defender Antivirus notifications may be sent to or persist 3. Click **OK**. -This prevents notifications from Windows Defender AV appearing in the action center on Windows 10 when scans or remediation is performed. +This prevents notifications from Microsoft Defender AV appearing in the action center on Windows 10 when scans or remediation is performed. ### Disable scans after an update @@ -253,7 +253,7 @@ This forces a scan if the VM has missed two or more consecutive scheduled scans. 2. Click **OK**. -This hides the entire Windows Defender AV user interface from users. +This hides the entire Microsoft Defender AV user interface from users. ### Exclusions diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md index 69f126b8f8..84f310871d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md @@ -26,7 +26,7 @@ ms.custom: nextgen > The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates. Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Windows Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) You can enable or disable Microsoft Defender Antivirus cloud-delivered protection with Microsoft Intune, Microsoft Endpoint Configuration Manager, Group Policy, PowerShell cmdlets, or on individual clients in the Windows Security app. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md index 8e83b95ad4..fdc1e748f8 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus.md @@ -37,7 +37,7 @@ By default, Microsoft Defender Antivirus will enable itself on a Windows 10 devi If Microsoft Defender Antivirus is enabled, the usual options will appear to configure it on that device: -![Windows Security app showing Windows Defender AV options, including scan options, settings, and update options](images/vtp-wdav.png) +![Windows Security app showing Microsoft Defender AV options, including scan options, settings, and update options](images/vtp-wdav.png) If another antivirus product is installed and working correctly, Microsoft Defender Antivirus will disable itself. The Windows Security app will change the **Virus & threat protection** section to show status about the AV product, and provide a link to the product's configuration options: @@ -47,7 +47,7 @@ Underneath any third party AV products, a new link will appear as **Microsoft De ![The limited periodic option is a toggle to enable or disable **periodic scanning**](images/vtp-3ps-lps.png) -Sliding the switch to **On** will show the standard Windows Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page. +Sliding the switch to **On** will show the standard Microsoft Defender AV options underneath the third party AV product. The limited periodic scanning option will appear at the bottom of the page. ![When enabled, periodic scanning shows the normal Microsoft Defender Antivirus options](images/vtp-3ps-lps-on.png) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md index 6f5db8d1e5..c29455e452 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-event-based-updates-microsoft-defender-antivirus.md @@ -129,9 +129,9 @@ For more information, see [Windows Defender WMIv2 APIs](https://docs.microsoft.c ## Allow ad hoc changes to protection based on cloud-delivered protection -Windows Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates. +Microsoft Defender AV can make changes to its protection based on cloud-delivered protection. Such changes can occur outside of normal or scheduled protection updates. -If you have enabled cloud-delivered protection, Windows Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Windows Defender AV to automatically receive that protection update. Other important protection updates can also be applied. +If you have enabled cloud-delivered protection, Microsoft Defender AV will send files it is suspicious about to the Windows Defender cloud. If the cloud service reports that the file is malicious, and the file is detected in a recent protection update, you can use Group Policy to configure Microsoft Defender AV to automatically receive that protection update. Other important protection updates can also be applied. ### Use Group Policy to automatically download recent updates based on cloud-delivered protection diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md index 6d5ec2c418..8956c31df7 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Apply Windows Defender AV protection updates to out of date endpoints +title: Apply Microsoft Defender AV protection updates to out of date endpoints description: Define when and how updates should be applied for endpoints that have not updated in a while. keywords: updates, protection, out-of-date, outdated, old, catch-up search.product: eADQiWindows 10XVcnh @@ -56,7 +56,7 @@ If Microsoft Defender Antivirus did not download protection updates for a specif 4. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates**. -5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to check for and download the latest protection update. +5. Double-click the **Define the number of days after which a catch-up security intelligence update is required** setting and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to check for and download the latest protection update. 6. Click **OK**. @@ -96,11 +96,11 @@ You can also specify the number of days after which Microsoft Defender Antivirus 5. Expand the tree to **Windows components > Microsoft Defender Antivirus > Signature Updates** and configure the following settings: - 1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to consider spyware Security intelligence to be out-of-date. + 1. Double-click **Define the number of days before spyware definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider spyware Security intelligence to be out-of-date. 2. Click **OK**. - 3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Windows Defender AV to consider virus Security intelligence to be out-of-date. + 3. Double-click **Define the number of days before virus definitions are considered out of date** and set the option to **Enabled**. Enter the number of days after which you want Microsoft Defender AV to consider virus Security intelligence to be out-of-date. 4. Click **OK**. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md index d3a6243859..fb6976a1fa 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Manage how and where Windows Defender AV receives updates +title: Manage how and where Microsoft Defender AV receives updates description: Manage the fallback order for how Microsoft Defender Antivirus receives protection updates. keywords: updates, security baselines, protection, fallback order, ADL, MMPC, UNC, file path, share, wsus search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md index 81ba39a7cc..fb9cbcf454 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Define how mobile devices are updated by Windows Defender AV -description: Manage how mobile devices, such as laptops, should be updated with Windows Defender AV protection updates. +title: Define how mobile devices are updated by Microsoft Defender AV +description: Manage how mobile devices, such as laptops, should be updated with Microsoft Defender AV protection updates. keywords: updates, protection, schedule updates, battery, mobile device, laptop, notebook, opt-in, microsoft update, wsus, override search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md index f0ebabb8e5..4be2a05301 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Next-generation protection in Windows 10, Windows Server 2016, and Windows Server 2019 -description: Learn how to manage, configure, and use Windows Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016 +description: Learn how to manage, configure, and use Microsoft Defender AV, the built-in antimalware and antivirus product available in Windows 10 and Windows Server 2016 keywords: Microsoft Defender Antivirus, windows defender, antimalware, scep, system center endpoint protection, system center configuration manager, virus, malware, threat, detection, protection, security search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 4cf3a8a1e7..5018ae9f9d 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -1,6 +1,6 @@ --- title: Microsoft Defender Antivirus on Windows Server 2016 and 2019 -description: Enable and configure Windows Defender AV on Windows Server 2016 and 2019 +description: Enable and configure Microsoft Defender AV on Windows Server 2016 and 2019 keywords: windows defender, server, scep, system center endpoint protection, server 2016, current branch, server 2012 search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -91,7 +91,7 @@ To use PowerShell to install Microsoft Defender Antivirus, run the following cmd Install-WindowsFeature -Name Windows-Defender ``` -Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Windows Defender AV Events](troubleshoot-microsoft-defender-antivirus.md). +Event messages for the antimalware engine included with Microsoft Defender Antivirus can be found in [Microsoft Defender AV Events](troubleshoot-microsoft-defender-antivirus.md). ## Verify Microsoft Defender Antivirus is running @@ -190,14 +190,14 @@ If you determine you do want to uninstall Microsoft Defender Antivirus, follow t If you unselect **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**. - Windows Defender AV will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. + Microsoft Defender AV will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. ### Uninstall Microsoft Defender Antivirus using PowerShell >[!NOTE] >You can't uninstall the Windows Security app, but you can disable the interface with these instructions. -The following PowerShell cmdlet will also uninstall Windows Defender AV on Windows Server 2016 or 2019: +The following PowerShell cmdlet will also uninstall Microsoft Defender AV on Windows Server 2016 or 2019: ```PowerShell Uninstall-WindowsFeature -Name Windows-Defender @@ -216,6 +216,6 @@ Uninstall-WindowsFeature -Name Windows-Defender-GUI - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -- [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) +- [Configure exclusions in Microsoft Defender AV on Windows Server](configure-server-exclusions-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md index 636b470f3c..103ede404e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-offline.md @@ -48,7 +48,7 @@ To run Microsoft Defender Offline from the endpoint, the user must be logged in Microsoft Defender Offline uses the most recent protection updates available on the endpoint; it's updated whenever Windows Defender Antivirus is updated. > [!NOTE] -> Before running an offline scan, you should attempt to update Windows Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). +> Before running an offline scan, you should attempt to update Microsoft Defender AV protection. You can either force an update with Group Policy or however you normally deploy updates to endpoints, or you can manually download and install the latest protection updates from the [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/definitions/adl.aspx). See the [Manage Microsoft Defender Antivirus Security intelligence updates](manage-protection-updates-microsoft-defender-antivirus.md) topic for more information. @@ -75,7 +75,7 @@ Microsoft Defender Offline scans are indicated under **Malware remediation statu ## Configure notifications -Microsoft Defender Offline notifications are configured in the same policy setting as other Windows Defender AV notifications. +Microsoft Defender Offline notifications are configured in the same policy setting as other Microsoft Defender AV notifications. For more information about notifications in Windows Defender, see the [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) topic. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md index 36f41c59d3..c2d53844a7 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-security-center-antivirus.md @@ -1,6 +1,6 @@ --- title: Microsoft Defender Antivirus in the Windows Security app -description: With Windows Defender AV now included in the Windows Security app, you can review, compare, and perform common tasks. +description: With Microsoft Defender AV now included in the Windows Security app, you can review, compare, and perform common tasks. keywords: wdav, antivirus, firewall, security, windows search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -27,8 +27,8 @@ In Windows 10, version 1703 and later, the Windows Defender app is part of the W Settings that were previously part of the Windows Defender client and main Windows Settings have been combined and moved to the new app, which is installed by default as part of Windows 10, version 1703. > [!IMPORTANT] -> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.
If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. ->It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. +> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). These are disabled automatically when a third-party antivirus or firewall product is installed and kept up to date.
If you do disable the Windows Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +>It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. >This will significantly lower the protection of your device and could lead to malware infection. @@ -108,7 +108,7 @@ This section describes how to perform some of the most common tasks when reviewi >[!NOTE] >If you switch **Real-time protection** off, it will automatically turn back on after a short delay. This is to ensure you are protected from malware and threats. - >If you install another antivirus product, Windows Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). + >If you install another antivirus product, Microsoft Defender AV will automatically disable itself and will indicate this in the Windows Security app. A setting will appear that will allow you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md). diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/oldTOC.md b/windows/security/threat-protection/microsoft-defender-antivirus/oldTOC.md index 6e1deba9b5..3c99217e75 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/oldTOC.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/oldTOC.md @@ -1,12 +1,12 @@ # [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) -## [Windows Defender AV in the Microsoft Defender Security Center app](microsoft-defender-security-center-antivirus.md) +## [Microsoft Defender AV in the Microsoft Defender Security Center app](microsoft-defender-security-center-antivirus.md) -## [Windows Defender AV on Windows Server 2016](microsoft-defender-antivirus-on-windows-server-2016.md) +## [Microsoft Defender AV on Windows Server 2016](microsoft-defender-antivirus-on-windows-server-2016.md) ## [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md) -### [Use limited periodic scanning in Windows Defender AV](limited-periodic-scanning-microsoft-defender-antivirus.md) +### [Use limited periodic scanning in Microsoft Defender AV](limited-periodic-scanning-microsoft-defender-antivirus.md) ## [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md) @@ -35,18 +35,18 @@ ### [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md) #### [Detect and block Potentially Unwanted Applications](detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md) #### [Enable and configure always-on protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md) -### [Configure end-user interaction with Windows Defender AV](configure-end-user-interaction-microsoft-defender-antivirus.md) +### [Configure end-user interaction with Microsoft Defender AV](configure-end-user-interaction-microsoft-defender-antivirus.md) #### [Configure the notifications that appear on endpoints](configure-notifications-microsoft-defender-antivirus.md) #### [Prevent users from seeing or interacting with the user interface](prevent-end-user-interaction-microsoft-defender-antivirus.md) #### [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-microsoft-defender-antivirus.md) ## [Customize, initiate, and review the results of scans and remediation](customize-run-review-remediate-scans-microsoft-defender-antivirus.md) -### [Configure and validate exclusions in Windows Defender AV scans](configure-exclusions-microsoft-defender-antivirus.md) +### [Configure and validate exclusions in Microsoft Defender AV scans](configure-exclusions-microsoft-defender-antivirus.md) #### [Configure and validate exclusions based on file name, extension, and folder location](configure-extension-file-exclusions-microsoft-defender-antivirus.md) #### [Configure and validate exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) -#### [Configure exclusions in Windows Defender AV on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) -### [Configure scanning options in Windows Defender AV](configure-advanced-scan-types-microsoft-defender-antivirus.md) +#### [Configure exclusions in Microsoft Defender AV on Windows Server 2016](configure-server-exclusions-microsoft-defender-antivirus.md) +### [Configure scanning options in Microsoft Defender AV](configure-advanced-scan-types-microsoft-defender-antivirus.md) ### [Configure remediation for scans](configure-remediation-microsoft-defender-antivirus.md) ### [Configure scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md) ### [Configure and run scans](run-scan-microsoft-defender-antivirus.md) @@ -59,10 +59,10 @@ ## [Reference topics for management and configuration tools](configuration-management-reference-microsoft-defender-antivirus.md) -### [Use Group Policy settings to configure and manage Windows Defender AV](use-group-policy-microsoft-defender-antivirus.md) -### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](use-intune-config-manager-microsoft-defender-antivirus.md) -### [Use PowerShell cmdlets to configure and manage Windows Defender AV](use-powershell-cmdlets-microsoft-defender-antivirus.md) -### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](use-wmi-microsoft-defender-antivirus.md) -### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](command-line-arguments-microsoft-defender-antivirus.md) +### [Use Group Policy settings to configure and manage Microsoft Defender AV](use-group-policy-microsoft-defender-antivirus.md) +### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Microsoft Defender AV](use-intune-config-manager-microsoft-defender-antivirus.md) +### [Use PowerShell cmdlets to configure and manage Microsoft Defender AV](use-powershell-cmdlets-microsoft-defender-antivirus.md) +### [Use Windows Management Instrumentation (WMI) to configure and manage Microsoft Defender AV](use-wmi-microsoft-defender-antivirus.md) +### [Use the mpcmdrun.exe commandline tool to configure and manage Microsoft Defender AV](command-line-arguments-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md index 4b5dfb5cc2..18c0fdfc15 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/prevent-end-user-interaction-microsoft-defender-antivirus.md @@ -44,7 +44,7 @@ In earlier versions of Windows 10, the setting will hide the Windows Defender cl ![Warning message when headless mode is enabled in Windows 10, versions earlier than 1703](images/defender/wdav-headless-mode-1607.png) -## Use Group Policy to hide the Windows Defender AV interface from users +## Use Group Policy to hide the Microsoft Defender AV interface from users 1. On your Group Policy management machine, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/desktop/gpmc/group-policy-management-console-portal), right-click the Group Policy Object you want to configure and click **Edit**. diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md index af0ed9fd05..aa0b387ceb 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md @@ -1,7 +1,7 @@ --- title: Monitor and report on Microsoft Defender Antivirus protection -description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Windows Defender AV with PowerShell and WMI. -keywords: siem, monitor, report, windows defender av +description: Use Configuration Manager or security information and event management (SIEM) tools to consume reports, and monitor Microsoft Defender AV with PowerShell and WMI. +keywords: siem, monitor, report, Microsoft Defender AV search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md index 5a30c57794..325b0800ee 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/restore-quarantined-files-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- -title: Restore quarantined files in Windows Defender AV -description: You can restore files and folders that were quarantined by Windows Defender AV. +title: Restore quarantined files in Microsoft Defender AV +description: You can restore files and folders that were quarantined by Microsoft Defender AV. keywords: search.product: eADQiWindows 10XVcnh ms.pagetype: security @@ -17,7 +17,7 @@ ms.reviewer: manager: dansimp --- -# Restore quarantined files in Windows Defender AV +# Restore quarantined files in Microsoft Defender AV **Applies to:** diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md index 258b495b60..1e4a2b7142 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/review-scan-results-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Review the results of Windows Defender AV scans +title: Review the results of Microsoft Defender AV scans description: Review the results of scans using Microsoft Endpoint Configuration Manager, Microsoft Intune, or the Windows Security app keywords: scan results, remediation, full scan, quick scan search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md index 0d9933fc95..a0fc81be46 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/run-scan-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Run and customize on-demand scans in Windows Defender AV +title: Run and customize on-demand scans in Microsoft Defender AV description: Run and configure on-demand scans using PowerShell, Windows Management Instrumentation, or individually on endpoints with the Windows Security app keywords: scan, on-demand, dos, intune, instant scan search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md index 6dd4dadced..a155de8626 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Schedule regular quick and full scans with Windows Defender AV +title: Schedule regular quick and full scans with Microsoft Defender AV description: Set up recurring (scheduled) scans, including when they should run and whether they run as full or quick scans keywords: quick scan, full scan, quick vs full, schedule scan, daily, weekly, time, scheduled, recurring, regular search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md index 68ce4eebbd..75665404c2 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Windows Defender AV event IDs and error codes +title: Microsoft Defender AV event IDs and error codes description: Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors keywords: event, error code, siem, logging, troubleshooting, wef, windows event forwarding search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md index 8abffb90b1..43310f4b21 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-reporting.md @@ -1,7 +1,7 @@ --- -title: Troubleshoot problems with reporting tools for Windows Defender AV -description: Identify and solve common problems when attempting to report in Windows Defender AV protection status in Update Compliance -keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, windows defender av +title: Troubleshoot problems with reporting tools for Microsoft Defender AV +description: Identify and solve common problems when attempting to report in Microsoft Defender AV protection status in Update Compliance +keywords: troubleshoot, error, fix, update compliance, oms, monitor, report, Microsoft Defender AV search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -51,9 +51,9 @@ There are three steps to troubleshooting these problems: In order for devices to properly show up in Update Compliance, you have to meet certain prerequisites for both the Update Compliance service and for Microsoft Defender Antivirus: >[!div class="checklist"] ->- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. +>- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](microsoft-defender-antivirus-compatibility.md) and the endpoint will not be reported in Update Compliance. > - [Cloud-delivered protection is enabled](enable-cloud-protection-microsoft-defender-antivirus.md). -> - Endpoints can [connect to the Windows Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud) +> - Endpoints can [connect to the Microsoft Defender AV cloud](configure-network-connections-microsoft-defender-antivirus.md#validate-connections-between-your-network-and-the-cloud) > - If the endpoint is running Windows 10 version 1607 or earlier, [Windows 10 diagnostic data must be set to the Enhanced level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level). > - It has been 3 days since all requirements have been met diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md index a6ba01f23b..37d31d6dc7 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-intune-config-manager-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Configure Microsoft Defender Antivirus with Configuration Manager and Intune -description: Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure Windows Defender AV and Endpoint Protection +description: Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure Microsoft Defender AV and Endpoint Protection keywords: scep, intune, endpoint protection, configuration search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md index fcfc8ca38c..2ec659113a 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus.md @@ -1,5 +1,5 @@ --- -title: Use PowerShell cmdlets to configure and run Windows Defender AV +title: Use PowerShell cmdlets to configure and run Microsoft Defender AV description: In Windows 10, you can use PowerShell cmdlets to run scans, update Security intelligence, and change settings in Microsoft Defender Antivirus. keywords: scan, command line, mpcmdrun, defender search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md index 73d1b7d19f..5a54bd4546 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus.md @@ -1,6 +1,6 @@ --- title: Configure Microsoft Defender Antivirus with WMI -description: Use WMI scripts to configure Windows Defender AV. +description: Use WMI scripts to configure Microsoft Defender AV. keywords: wmi, scripts, windows management instrumentation, configuration search.product: eADQiWindows 10XVcnh ms.pagetype: security diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md index 6e52508bcb..e998e86722 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md @@ -25,7 +25,7 @@ ms.custom: nextgen Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models. Microsoft Defender Antivirus uses multiple detection and prevention technologies to deliver accurate, real-time, and intelligent protection. [Get to know the advanced technologies at the core of Microsoft Defender ATP next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/). -![List of Windows Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) +![List of Microsoft Defender AV engines](images/microsoft-defender-atp-next-generation-protection-engines.png) To take advantage of the power and speed of these next-generation technologies, Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. These cloud protection services, also referred to as Microsoft Advanced Protection Service (MAPS), enhances standard real-time protection, providing arguably the best antivirus defense. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md index cc79291b60..579cc8db74 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 12/04/2019 +ms.date: 06/02/2020 ms.reviewer: manager: dansimp ms.custom: asr @@ -91,4 +91,20 @@ Yes, both the Enterprise Resource domains hosted in the cloud and the Domains ca ### Why does my encryption driver break Microsoft Defender Application Guard? -Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT"). + +Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message ("0x80070013 ERROR_WRITE_PROTECT"). + +### Why do the Network Isolation policies in Group Policy and CSP look different? + +There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatary network isolation policies to deploy WDAG are different between CSP and GP. + +Mandatory network isolation GP policy to deploy WDAG: "DomainSubnets or CloudResources" +Mandatory network isolation CSP policy to deploy WDAG: "EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)" +For EnterpriseNetworkDomainNames, there is no mapped CSP policy. + +Windows Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, WDAG will not work and result in an error message (`0x80070013 ERROR_WRITE_PROTECT`). + +### Why did Application Guard stop working after I turned off hyperthreading? + +If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements. + diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 652cc3b40b..9a278e3b9b 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -48,4 +48,4 @@ Application Guard has been created to target several types of systems: |[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| -|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| \ No newline at end of file +|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 0a28ea14cd..977cd7c2dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -23,7 +23,7 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats. +Advanced hunting is a query-based threat-hunting tool that lets you explore raw data for the last 30 days. You can proactively inspect events in your network to locate interesting indicators and entities. The flexible access to data facilitates unconstrained hunting for both known and potential threats. You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. @@ -54,4 +54,4 @@ Take advantage of the following functionality to write queries faster: - [Use shared queries](advanced-hunting-shared-queries.md) - [Understand the schema](advanced-hunting-schema-reference.md) - [Apply query best practices](advanced-hunting-best-practices.md) -- [Custom detections overview](overview-custom-detections.md) \ No newline at end of file +- [Custom detections overview](overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md index 7f13a487ad..34e1b7c512 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md @@ -58,16 +58,16 @@ Informational
(Grey) | Alerts that might not be considered harmful to the n #### Understanding alert severity -Microsoft Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes. +Microsoft Defender Antivirus (Microsoft Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes. -The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected. +The Microsoft Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected. The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization. So, for example: -- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage. -- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. +- The severity of a Microsoft Defender ATP alert about a Microsoft Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage. +- An alert about a commercial malware was detected while executing, but blocked and remediated by Microsoft Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. - An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". - Suspicious behavioral alerts, which weren't blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md index 2ec8ca9023..2fdc0af72f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md @@ -43,7 +43,7 @@ Field numbers match the numbers in the images below. > > | Portal label | SIEM field name | ArcSight field | Example value | Description | > |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | +> | 1 | AlertTitle | name | Microsoft Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | > | 2 | Severity | deviceSeverity | High | Value available for every Detection. | > | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. | > | 4 | Detection source | sourceServiceName | Antivirus | Microsoft Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. | @@ -53,13 +53,13 @@ Field numbers match the numbers in the images below. > | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. | > | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. | > | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. | -> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. | -> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. | -> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. | +> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Microsoft Defender AV detections. | +> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Microsoft Defender AV detections. | +> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Microsoft Defender AV detections. | > | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | > | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | -> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Microsoft Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | > | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. | > | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. | > | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. | diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 6893fc8c8d..c3acfa8df0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -151,7 +151,7 @@ Support for Windows Server, provide deeper insight into activities happening on 1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md). -2. If you're running a third-party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings. Verify that it was configured correctly: +2. If you're running a third-party antimalware solution, you'll need to apply the following Microsoft Defender AV passive mode settings. Verify that it was configured correctly: 1. Set the following registry entry: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` @@ -168,11 +168,11 @@ Support for Windows Server, provide deeper insight into activities happening on ![Image of passive mode verification result](images/atp-verify-passive-mode.png) -3. Run the following command to check if Windows Defender AV is installed: +3. Run the following command to check if Microsoft Defender AV is installed: ```sc.exe query Windefend``` - If the result is 'The specified service does not exist as an installed service', then you'll need to install Windows Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). + If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). ## Integration with Azure Security Center diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md index dc345b0974..61cf625503 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md @@ -41,7 +41,7 @@ Group Policy settings that disable local administrator list merging will overrid * Microsoft Defender Antivirus **Configure local administrator merge behavior for lists** * System Center Endpoint Protection **Allow users to add exclusions and overrides** -For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). +For more information about disabling local list merging, see [Prevent or allow users to locally modify Microsoft Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-local-policy-overrides-microsoft-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). ## Windows Security app diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index 47494dd290..ba6d70f4b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -61,7 +61,7 @@ For more information on these actions, see [Take response action on a file](resp The file details, incident, malware detection, and file prevalence cards display various attributes about the file. -You'll see details such as the file’s MD5, the Virus Total detection ratio, and Windows Defender AV detection if available, and the file’s prevalence, both worldwide and within your organizations. +You'll see details such as the file’s MD5, the Virus Total detection ratio, and Microsoft Defender AV detection if available, and the file’s prevalence, both worldwide and within your organizations. ![Image of file information](images/atp-file-information.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index e3e6a5d05e..c2f2dd8964 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -30,13 +30,13 @@ Indicator of compromise (IoCs) matching is an essential feature in every endpoin Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. -Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). +Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Microsoft Defender AV). **Cloud detection engine**
The cloud detection engine of Microsoft Defender ATP regularly scans collected data and tries to match the indicators you set. When there is a match, action will be taken according to the settings you specified for the IoC. **Endpoint prevention engine**
-The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. +The same list of indicators is honored by the prevention agent. Meaning, if Microsoft Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Microsoft Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Microsoft Defender AV will not detect nor block the file from being run. **Automated investigation and remediation engine**
The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". @@ -153,7 +153,7 @@ It's important to understand the following prerequisites prior to creating indic You can create indicators for certificates. Some common use cases include: - Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) and [controlled folder access](controlled-folders.md) but need to allow behaviors from signed applications by adding the certificate in the allow list. -- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. ### Before you begin diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 874368fd85..eb56826c55 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -44,11 +44,11 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network ## Requirements -Network protection requires Windows 10 Pro, Enterprise E3, E5 and Windows Defender AV real-time protection. +Network protection requires Windows 10 Pro, Enterprise E3, E5 and Microsoft Defender AV real-time protection. Windows 10 version | Microsoft Defender Antivirus -|- -Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled +Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled ## Review network protection events in the Microsoft Defender ATP Security Center diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md index 261734d68b..0d13fe8b36 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md @@ -28,6 +28,8 @@ Microsoft Defender ATP endpoint detection and response capabilities provide adva When a threat is detected, alerts are created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called an _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats. +>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4o1j5] + Inspired by the "assume breach" mindset, Microsoft Defender ATP continuously collects behavioral cyber telemetry. This includes process information, network activities, deep optics into the kernel and memory manager, user login activities, registry and file system changes, and others. The information is stored for six months, enabling an analyst to travel back in time to the start of an attack. The analyst can then pivot in various views and approach an investigation through multiple vectors. The response capabilities give you the power to promptly remediate threats by acting on the affected entities. diff --git a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md index d14ef73895..96e8c08aa9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md @@ -81,7 +81,7 @@ Icon | Description ![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the machine. ![Thunderbolt icon](images/atp-thunderbolt-icon.png)| Indicates events that triggered an alert in the **Alert process tree**. ![Machine icon](images/atp-machine-icon.png)| Machine icon -![Windows Defender AV events icon](images/atp-windows-defender-av-events-icon.png)| Microsoft Defender Antivirus events +![Microsoft Defender AV events icon](images/atp-windows-defender-av-events-icon.png)| Microsoft Defender Antivirus events ![Application Guard events icon](images/atp-Application-Guard-events-icon.png)| Windows Defender Application Guard events ![Device Guard events icon](images/atp-Device-Guard-events-icon.png)| Windows Defender Device Guard events ![Exploit Guard events icon](images/atp-Exploit-Guard-events-icon.png)| Windows Defender Exploit Guard events diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md index 8fbea48837..7d64a9e1f9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md @@ -116,13 +116,13 @@ As part of the investigation or response process, you can remotely initiate an a >[!IMPORTANT] >- This action is available for machines on Windows 10, version 1709 or later. ->- A Microsoft Defender Antivirus (Windows Defender AV) scan can run alongside other antivirus solutions, whether Windows Defender AV is the active antivirus solution or not. Windows Defender AV can be in Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). +>- A Microsoft Defender Antivirus (Microsoft Defender AV) scan can run alongside other antivirus solutions, whether Microsoft Defender AV is the active antivirus solution or not. Microsoft Defender AV can be in Passive mode. For more information, see [Microsoft Defender Antivirus compatibility](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). One you have selected **Run antivirus scan**, select the scan type that you'd like to run (quick or full) and add a comment before confirming the scan. ![Image of notification to select quick scan or full scan and add comment](images/run-antivirus.png) -The Action center will show the scan information and the machine timeline will include a new event, reflecting that a scan action was submitted on the machine. Windows Defender AV alerts will reflect any detections that surfaced during the scan. +The Action center will show the scan information and the machine timeline will include a new event, reflecting that a scan action was submitted on the machine. Microsoft Defender AV alerts will reflect any detections that surfaced during the scan. ## Restrict app execution diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md index 5c669d24fa..8f87ff3707 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md @@ -46,7 +46,7 @@ Attack surface reduction rules will only work on devices with the following cond - Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). -- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). +- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). - [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index 2ee2db32a1..12ce265639 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -43,7 +43,7 @@ Network protection will only work on devices with the following conditions: >[!div class="checklist"] > * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update). -> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). +> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). > * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled. > * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled. > * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**). diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md index 7917efbce4..b57e36e03e 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md @@ -20,18 +20,18 @@ ms.date: 04/19/2017 # Minimum password length **Applies to** -- Windows 10 +- Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting. ## Reference -The **Minimum password length** policy setting determines the least number of characters that can make up a password for a user account. You can set a value of between 1 and 14 characters, or you can establish that no password is required by setting the number of characters to 0. +The **Minimum password length** policy setting determines the least number of characters that can make up a password for a user account. You can set a value of between 1 and 20 characters, or you can establish that no password is required by setting the number of characters to 0. ### Possible values -- User-specified number of characters between 0 and 14 -- Not defined +- User-specified number of characters between 0 and 20 +- Not defined ### Best practices @@ -51,13 +51,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| 7 characters| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | 0 characters| -| Domain controller effective default settings | 7 characters| -| Member server effective default settings | 7 characters| -| Effective GPO default settings on client computers | 0 characters| - +| Default domain policy| 7 characters| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | 0 characters| +| Domain controller effective default settings | 7 characters| +| Member server effective default settings | 7 characters| +| Effective GPO default settings on client computers | 0 characters| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -80,8 +80,9 @@ Configure the **** policy setting to a value of 8 or more. If the number of char In most environments, we recommend an eight-character password because it is long enough to provide adequate security, but not too difficult for users to easily remember. This configuration provides adequate defense against a brute force attack. Using the [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) policy setting in addition to the **Minimum password length** setting helps reduce the possibility of a dictionary attack. ->**Note:**  Some jurisdictions have established legal requirements for password length as part of establishing security regulations. - +> [!NOTE] +> Some jurisdictions have established legal requirements for password length as part of establishing security regulations. + ### Potential impact Requirements for extremely long passwords can actually decrease the security of an organization because users might leave the information in an unsecured location or lose it. If very long passwords are required, mistyped passwords could cause account lockouts and increase the volume of Help Desk calls. If your organization has issues with forgotten passwords due to password length requirements, consider teaching your users about passphrases, which are often easier to remember and, due to the larger number of character combinations, much harder to discover. diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index 5020c63596..61bdb73f63 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -1,6 +1,6 @@ --- -title: Configure the Group Policy settings for Windows Defender Application Guard (Windows 10) -description: Learn about the available Group Policy settings for Windows Defender Application Guard. +title: Configure the Group Policy settings for Microsoft Defender Application Guard (Windows 10) +description: Learn about the available Group Policy settings for Microsoft Defender Application Guard. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -14,12 +14,12 @@ manager: dansimp ms.custom: asr --- -# Configure Windows Defender Application Guard policy settings +# Configure Microsoft Defender Application Guard policy settings **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Windows Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain. +Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain. Application Guard uses both network isolation and application-specific settings. @@ -36,7 +36,7 @@ These settings, located at **Computer Configuration\Administrative Templates\Net |-----------|------------------|-----------| |Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| |Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| -|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Proxies should be added to this list. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| ## Network isolation settings wildcards diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index d6c9634430..0f263a291a 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -42,7 +42,7 @@ You can't uninstall the Windows Security app, but you can do one of the followin - Disable the interface on Windows Server 2016. See [Microsoft Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016). - Hide all of the sections on client computers (see below). -- Disable Microsoft Defender Antivirus, if needed. See [Enable and configure Windows Defender AV always-on protection and monitoring](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). +- Disable Microsoft Defender Antivirus, if needed. See [Enable and configure Microsoft Defender AV always-on protection and monitoring](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics: @@ -77,20 +77,20 @@ You can find more information about each section, including options for configur ## How the Windows Security app works with Windows security features > [!IMPORTANT] -> Windows Defender AV and the Windows Security app use similarly named services for specific purposes. +> Microsoft Defender AV and the Windows Security app use similarly named services for specific purposes. > > The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. > ->These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. +>These services do not affect the state of Microsoft Defender AV. Disabling or modifying these services will not disable Microsoft Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. > ->Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). +>Microsoft Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md). > -> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). +> Disabling the Windows Security Center service will not disable Microsoft Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). > [!WARNING] > If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. > -> It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. +> It may also prevent Microsoft Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. > > This will significantly lower the protection of your device and could lead to malware infection. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index d39a343109..8c41f40e80 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -83,9 +83,9 @@ Endpoint detection and response is improved. Enterprise customers can now take a - [Configuring features](/windows/threat-protection/microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features) - [Troubleshooting](/windows/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus) - Some of the highlights of the new library include [Evaluation guide for Windows Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) and [Deployment guide for Windows Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus). + Some of the highlights of the new library include [Evaluation guide for Microsoft Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) and [Deployment guide for Microsoft Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus). - New features for Windows Defender AV in Windows 10 Enterprise 2019 LTSC include: + New features for Microsoft Defender AV in Windows 10 Enterprise 2019 LTSC include: - [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus) - [The ability to specify the level of cloud-protection](/windows/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus) - [Microsoft Defender Antivirus protection in the Windows Defender Security Center app](/windows/threat-protection/microsoft-defender-antivirus/windows-defender-security-center-antivirus) diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 8421a263ce..2f32d6a64d 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -138,10 +138,10 @@ The new library includes information on: - [Troubleshooting](/windows/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus) Some of the highlights of the new library include: -- [Evaluation guide for Windows Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) -- [Deployment guide for Windows Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus) +- [Evaluation guide for Microsoft Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) +- [Deployment guide for Microsoft Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus) -New features for Windows Defender AV in Windows 10, version 1703 include: +New features for Microsoft Defender AV in Windows 10, version 1703 include: - [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus) - [The ability to specify the level of cloud-protection](/windows/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus) @@ -150,7 +150,7 @@ New features for Windows Defender AV in Windows 10, version 1703 include: In Windows 10, version 1607, we [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment in version 1703 with [updated behavior monitoring and always-on real-time protection](/windows/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus). -You can read more about ransomware mitigations and detection capability in Windows Defender AV in the [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) and at the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). +You can read more about ransomware mitigations and detection capability in Microsoft Defender AV in the [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) and at the [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/). ### Device Guard and Credential Guard