mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge branch 'master' into mdatp
This commit is contained in:
Beth Levin
commit
c70761cfff
@ -14675,5 +14675,9 @@
|
||||
"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/user",
|
||||
"redirect_document_id": true
|
||||
}
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-indicators",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
]
|
||||
}
|
||||
|
||||
@ -49,7 +49,7 @@ To reset your HoloLens 2, go to **Settings > Update > Reset** and select **Reset
|
||||
|
||||
If the device is still having a problem after reset, you can use Advanced Recovery Companion to flash the device with a new image.
|
||||
|
||||
1. On your computer, get [Advanced Recovery Companion](need store link) from Microsoft Store.
|
||||
1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store.
|
||||
2. Connect HoloLens 2 to your computer.
|
||||
3. Start Advanced Recovery Companion.
|
||||
4. On the **Welcome** page, select your device.
|
||||
|
||||
@ -64,8 +64,11 @@ Surface Hubs use Azure AD join to:
|
||||
- Grant admin rights to the appropriate users in your Azure AD tenant.
|
||||
- Backup the device's BitLocker recovery key by storing it under the account that was used to Azure AD join the device. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD.
|
||||
### Automatic enrollment via Azure Active Directory join
|
||||
|
||||
Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory.
|
||||
|
||||
For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment).
|
||||
|
||||
### Which should I choose?
|
||||
|
||||
|
||||
@ -63,9 +63,12 @@ There are several items to download or create for offline-licensed apps. The app
|
||||
**To download an offline-licensed app**
|
||||
|
||||
1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com).
|
||||
2. Click **Manage**, and then choose **Apps & software**.
|
||||
3. Refine results by **License type** to show apps with offline licenses.
|
||||
4. Find the app you want to download, click the ellipses under **Actions**, and then choose **Download for offline use**.
|
||||
2. Click **Manage**.
|
||||
3. Under **Shopping Experience**, set **Show offline apps** to **On**.
|
||||
4. Click **Shop for my group**. Search for the required inbox-app, select it, change the License type to **Offline**, and click **Get the app**, which will add the app to your inventory.
|
||||
5. Click **Manage**. You now have access to download the appx bundle package metadata and license file.
|
||||
6. Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.)
|
||||
|
||||
- **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional.
|
||||
- **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required.
|
||||
- **To download an app license**: Choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. This is required.
|
||||
|
||||
@ -429,7 +429,7 @@ The following diagram shows the BitLocker configuration service provider in tree
|
||||
<p style="margin-left: 20px">The possible values for 'xx' are:</p>
|
||||
|
||||
- 0 = Empty
|
||||
- 1 = Use default recovery message and URL.
|
||||
- 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input").
|
||||
- 2 = Custom recovery message is set.
|
||||
- 3 = Custom recovery URL is set.
|
||||
- 'yy' = string of max length 900.
|
||||
|
||||
@ -338,7 +338,7 @@ Delete a provider
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-provderguid-tracelevel"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/TraceLevel**
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-providerguid-tracelevel"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/TraceLevel**
|
||||
Specifies the level of detail included in the trace log.
|
||||
|
||||
The data type is an integer.
|
||||
@ -407,7 +407,7 @@ Set provider **TraceLevel**
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-provderguid-keywords"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/Keywords**
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-providerguid-keywords"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords**
|
||||
Specifies the provider keywords to be used as MatchAnyKeyword for this provider.
|
||||
|
||||
the data type is a string.
|
||||
@ -461,7 +461,7 @@ Set provider **Keywords**
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-provderguid-state"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/State**
|
||||
<a href="" id="etwlog-collectors-collectorname-providers-providerguid-state"></a>**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/State**
|
||||
Specifies if this provider is enabled in the trace session.
|
||||
|
||||
The data type is a boolean.
|
||||
|
||||
@ -76,8 +76,8 @@ The data type is string. Supported operations are Get and Replace. Starting in W
|
||||
Specifies whether the proxy server should be used for local (intranet) addresses.
|
||||
Valid values:
|
||||
<ul>
|
||||
<li>0 (default) - Do not use proxy server for local addresses</li>
|
||||
<li>1 - Use proxy server for local addresses</li>
|
||||
<li>0 (default) - Use proxy server for local addresses</li>
|
||||
<li>1 - Do not use proxy server for local addresses</li>
|
||||
</ul>
|
||||
|
||||
The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported.
|
||||
|
||||
@ -66,6 +66,15 @@ Here are examples of data fields. The encoded 0xF000 is the standard delimiter/s
|
||||
```
|
||||
<Data></Data>
|
||||
```
|
||||
If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (`<![CDATA[...]]>`) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using 0xF000 as the delimiter/separator.
|
||||
|
||||
> [!Note]
|
||||
> `` is the entity encoding of 0xF000.
|
||||
|
||||
For example, the following syntax grants user rights to Authenticated Users and Replicator user groups:
|
||||
```
|
||||
<![CDATA[Authenticated UsersReplicator]]>
|
||||
```
|
||||
|
||||
<hr/>
|
||||
|
||||
|
||||
@ -401,7 +401,7 @@ Value type is chr. Supported operations include Get, Add, Replace, and Delete.
|
||||
Nodes under the PluginProfile are required when using a Microsoft Store based VPN plugin.
|
||||
|
||||
<a href="" id="vpnv2-profilename-pluginprofile-serverurllist"></a>**VPNv2/***ProfileName***/PluginProfile/ServerUrlList**
|
||||
Required for plug-in profiles. Comma separated list of servers in URL, hostname, or IP format.
|
||||
Required for plug-in profiles. Semicolon-separated list of servers in URL, hostname, or IP format.
|
||||
|
||||
Value type is chr. Supported operations include Get, Add, Replace, and Delete.
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win
|
||||
|
||||
In Log Analytics, go to **Settings > Connected sources > Windows telemetry** and verify that you are subscribed to the Windows Analytics solutions you intend to use.
|
||||
|
||||
Even though devices can take 2-3 days after enrollment to show up due to latency in the system, you can now verify the status of your devices with a few hours of running the deployment script as described in [You can now check on the status of your computers within hours of running the deployment script](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/) on the Windows Analytics blog.
|
||||
Even though devices can take 2-3 days after enrollment to show up due to latency in the system, you can now verify the status of your devices within a few hours of running the deployment script as described in [You can now check on the status of your computers within hours of running the deployment script](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/You-can-now-check-on-the-status-of-your-computers-within-hours/ba-p/187213) on the Tech Community Blog.
|
||||
|
||||
>[!NOTE]
|
||||
> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id," go to **Settings > Connected sources > Windows telemetry** remove the Upgrade Readiness solution, and then re-add it.
|
||||
|
||||
@ -29,7 +29,7 @@ Go to the [Azure portal](https://portal.azure.com), select **All services**, and
|
||||
|
||||
It's important to understand the difference between Azure Active Directory and an Azure subscription:
|
||||
|
||||
**Azure Active Directory** is the directory that Azure uses. Azure Active Directory (AD) is a separate service which sits by itself and is used by all of Azure and also Office 365.
|
||||
**Azure Active Directory** is the directory that Azure uses. Azure Active Directory (Azure AD) is a separate service which sits by itself and is used by all of Azure and also Office 365.
|
||||
|
||||
An **Azure subscription** is a container for billing, but also acts as a security boundary. Every Azure subscription has a trust relationship with at least one Azure AD instance. This means that a subscription trusts that directory to authenticate users, services, and devices.
|
||||
|
||||
|
||||
@ -18,14 +18,15 @@ Find the tools and resources you need to help deploy and support Windows as a se
|
||||
|
||||
Find the latest and greatest news on Windows 10 deployment and servicing.
|
||||
|
||||
**Working to make Windows updates clear and transparent**
|
||||
> [!VIDEO https://www.youtube-nocookie.com/embed/u5P20y39DrA]
|
||||
**Discovering the Windows 10 Update history pages**
|
||||
> [!VIDEO https://www.youtube-nocookie.com/embed/GADIXBf9R58]
|
||||
|
||||
Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. The Windows update history page is for anyone looking to gain an immediate, precise understanding of particular Windows update issues.
|
||||
|
||||
The latest news:
|
||||
<ul compact style="list-style: none">
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency">Improving the Windows 10 update experience with control, quality and transparency</a> - April 4, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Call-to-action-review-your-Windows-Update-for-Business-deferral/ba-p/394244">Call to action: review your Windows Update for Business deferral values</a> - April 3, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540">Windows 10, version 1809 designated for broad deployment</a> - March 28, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience">Data, insights and listening to improve the customer experience</a> - March 6, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Getting-to-know-the-Windows-update-history-pages/ba-p/355079">Getting to know the Windows update history pages</a> - February 21, 2019</li>
|
||||
|
||||
@ -106,7 +106,7 @@ The following resources provide additional information about using Windows Updat
|
||||
- regsvr32.exe wuwebv.dll
|
||||
7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
```
|
||||
netsh reset winsock
|
||||
netsh winsock reset
|
||||
```
|
||||
8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
```
|
||||
|
||||
@ -25,7 +25,7 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone)
|
||||
|
||||
## <a href="" id="bkmk-migrateall"></a>To migrate all user accounts and user settings
|
||||
|
||||
Links to detailed explanations of commands are available in the Related Topics section.
|
||||
|
||||
1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window:
|
||||
|
||||
@ -49,7 +49,7 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
|
||||
|
||||
## <a href="" id="bkmk-migratetwo"></a>To migrate two domain accounts (User1 and User2)
|
||||
|
||||
Links to detailed explanations of commands are available in the Related Topics section.
|
||||
|
||||
1. Log on to the source computer as an administrator, and specify:
|
||||
|
||||
@ -62,7 +62,7 @@ By default, all users are migrated. The only way to specify which users to inclu
|
||||
`loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml`
|
||||
|
||||
## <a href="" id="bkmk-migratemoveuserone"></a>To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain
|
||||
|
||||
Links to detailed explanations of commands are available in the Related Topics section.
|
||||
|
||||
1. Log on to the source computer as an administrator, and type the following at the command-line prompt:
|
||||
|
||||
|
||||
@ -155,14 +155,18 @@ The following table defines the endpoints for Connected User Experiences and Tel
|
||||
|
||||
Windows release | Endpoint
|
||||
--- | ---
|
||||
Windows 10, versions 1703 and 1709 | Diagnostics data: v10.vortex-win.data.microsoft.com/collect/v1</br></br>Functional: v20.vortex-win.data.microsoft.com/collect/v1</br>Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com/collect/v1</br>settings-win.data.microsoft.com
|
||||
Windows 10, version 1607 | v10.vortex-win.data.microsoft.com</br></br>settings-win.data.microsoft.com
|
||||
Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed| Diagnostics data: v10c.vortex-win.data.microsoft.com</br></br>Functional: v20.vortex-win.data.microsoft.com</br>Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>settings-win.data.microsoft.com
|
||||
Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | Diagnostics data: v10.events.data.microsoft.com</br></br>Functional: v20.vortex-win.data.microsoft.com</br>Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>settings-win.data.microsoft.com
|
||||
Windows 10, version 1709 or earlier | Diagnostics data: v10.vortex-win.data.microsoft.com</br></br>Functional: v20.vortex-win.data.microsoft.com</br>Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com</br>settings-win.data.microsoft.com
|
||||
Windows 7 and Windows 8.1 | vortex-win.data.microsoft.com
|
||||
|
||||
The following table defines the endpoints for other diagnostic data services:
|
||||
|
||||
| Service | Endpoint |
|
||||
| - | - |
|
||||
| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
|
||||
| | umwatsonc.events.data.microsoft.com |
|
||||
| | kmwatsonc.events.data.microsoft.com |
|
||||
| | ceuswatcab01.blob.core.windows.net |
|
||||
| | ceuswatcab02.blob.core.windows.net |
|
||||
| | eaus2watcab01.blob.core.windows.net |
|
||||
@ -170,7 +174,7 @@ The following table defines the endpoints for other diagnostic data services:
|
||||
| | weus2watcab01.blob.core.windows.net |
|
||||
| | weus2watcab02.blob.core.windows.net |
|
||||
| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
|
||||
| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
|
||||
| OneDrive app for Windows 10 | vortex.data.microsoft.com |
|
||||
|
||||
### Data use and access
|
||||
|
||||
@ -356,9 +360,9 @@ You can turn on or turn off System Center diagnostic data gathering. The default
|
||||
|
||||
The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server 2016 is **Enhanced**.
|
||||
|
||||
### Configure the operating system diagnostic data level
|
||||
## Configure the operating system diagnostic data level
|
||||
|
||||
You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
|
||||
You can configure your operating system diagnostic data settings using the management tools you’re already using, such as **Group Policy, MDM, or Windows Provisioning.** You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
|
||||
|
||||
Use the appropriate value in the table below when you configure the management policy.
|
||||
|
||||
@ -388,7 +392,7 @@ Use the [Policy Configuration Service Provider (CSP)](https://msdn.microsoft.com
|
||||
|
||||
### Use Registry Editor to set the diagnostic data level
|
||||
|
||||
Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
|
||||
Use Registry Editor to manually set the registry level on the devices in your organization, or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, the policy will replace the manually set registry level.
|
||||
|
||||
1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**.
|
||||
|
||||
|
||||
@ -21,17 +21,17 @@ ms.date: 01/17/2018
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1809
|
||||
- Windows 10, version 1803
|
||||
- Windows 10, version 1803
|
||||
|
||||
## Introduction
|
||||
The Diagnostic Data Viewer is a Windows app that lets you review the diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
|
||||
The Diagnostic Data Viewer is a Windows app that lets you review the Windows diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
|
||||
|
||||
## Install and Use the Diagnostic Data Viewer
|
||||
|
||||
You must turn on data viewing and download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
|
||||
You must download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
|
||||
|
||||
### Turn on data viewing
|
||||
Before you can use this tool, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device.
|
||||
Before you can use this tool for viewing Windows diagnostic data, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device. Note that this setting does not affect your Office data viewing or history.
|
||||
|
||||
**To turn on data viewing**
|
||||
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
|
||||
@ -44,7 +44,7 @@ Before you can use this tool, you must turn on data viewing in the **Settings**
|
||||
Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
|
||||
|
||||
### Start the Diagnostic Data Viewer
|
||||
You must start this app from the **Settings** panel.
|
||||
You can start this app from the **Settings** panel.
|
||||
|
||||
**To start the Diagnostic Data Viewer**
|
||||
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
|
||||
@ -58,29 +58,25 @@ You must start this app from the **Settings** panel.
|
||||
3. Close the Diagnostic Data Viewer app, use your device as you normally would for a few days, and then open Diagnostic Data Viewer again to review the updated list of diagnostic data.
|
||||
|
||||
>[!Important]
|
||||
>Turning on data viewing can use up to 1GB of disk space on your system drive. We strongly recommend that your turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
|
||||
>Turning on data viewing can use up to 1GB (by default) of disk space on your system drive. We strongly recommend that you turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
|
||||
|
||||
### Use the Diagnostic Data Viewer
|
||||
The Diagnostic Data Viewer provides you with the following features to view and filter your device's diagnostic data.
|
||||
|
||||
- **View your diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft.
|
||||
- **View your Windows diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft.
|
||||
|
||||
Selecting an event opens the detailed JSON view, which provides the exact details uploaded to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
|
||||
|
||||
>[!Important]
|
||||
>Seeing an event does not necessarily mean it has been uploaded yet. It’s possible that some events are still queued and will be uploaded at a later time.
|
||||
|
||||
|
||||
|
||||
|
||||
- **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text.
|
||||
|
||||
Selecting an event opens the detailed JSON view, with the matching text highlighted.
|
||||
|
||||
- **Filter your diagnostic event categories.** The apps Menu button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft.
|
||||
|
||||
Selecting a check box lets you filter between the diagnostic event categories.
|
||||
|
||||
|
||||
- **Filter your diagnostic event categories.** The app's **Menu** button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft. Selecting a check box lets you filter between the diagnostic event categories.
|
||||
|
||||
- **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others.
|
||||
|
||||
@ -93,8 +89,20 @@ The Diagnostic Data Viewer provides you with the following features to view and
|
||||
>[!Important]
|
||||
>All content in the Feedback Hub is publicly viewable. Therefore, make sure you don't put any personal info into your feedback comments.
|
||||
|
||||
- **View a summary of the data you've shared with us over time.** Available for users on build 19H1+, 'About my data' in Diagnostic Data Viewer lets you see an overview of the Windows data you've shared with Microsoft.
|
||||
|
||||
Through this feature, you can checkout how much data you send on average each day, the breakdown of your data by category, the top components and services that have sent data, and more.
|
||||
|
||||
>[!Important]
|
||||
>This content is a reflection of the history of Windows data the app has stored. If you'd like to have extended analyses, please modify the storage capacity of Diagnostic Data Viewer.
|
||||
|
||||
|
||||
|
||||
## View Office Diagnostic Data
|
||||
By default, Diagnostic Data Viewer shows you Windows data. You can also view Office diagnostic data by enabling the feature in the app settings page. To learn more about how to view Office diagnostic data, please visit this [page](https://go.microsoft.com/fwlink/?linkid=2023830).
|
||||
|
||||
## Turn off data viewing
|
||||
When you're done reviewing your diagnostic data, you should turn of data viewing.
|
||||
When you're done reviewing your diagnostic data, you should turn of data viewing. This will also remove your Windows data history. Note that this setting does not affect your Office data viewing or history.
|
||||
|
||||
**To turn off data viewing**
|
||||
1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
|
||||
@ -103,8 +111,24 @@ When you're done reviewing your diagnostic data, you should turn of data viewing
|
||||
|
||||
|
||||
|
||||
## Modifying the size of your data history
|
||||
By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first.
|
||||
|
||||
>[!Important]
|
||||
>Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified.
|
||||
|
||||
**Modify the size of your data history**
|
||||
|
||||
To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached.
|
||||
|
||||
>[!Important]
|
||||
>Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine.
|
||||
|
||||
|
||||
|
||||
## View additional diagnostic data in the View problem reports tool
|
||||
Available on Windows 1809 and higher, you can review additional Windows Error Reporting diagnostic data in the **View problem reports** page within the Diagnostic Data Viewer.
|
||||
|
||||
This page provides you with a summary of various crash reports that are sent to Microsoft as part of Windows Error Reporting.
|
||||
We use this data to find and fix specific issues that are hard to replicate and to improve the Windows operating system.
|
||||
|
||||
@ -123,3 +147,4 @@ Go to **Start** and search for _Problem Reports_.
|
||||
The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft.
|
||||
|
||||
|
||||
|
||||
|
||||
BIN
windows/privacy/images/ddv-analytics.png
Normal file
BIN
windows/privacy/images/ddv-analytics.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 53 KiB |
BIN
windows/privacy/images/ddv-event-view.jpg
Normal file
BIN
windows/privacy/images/ddv-event-view.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 337 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 149 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 105 KiB After Width: | Height: | Size: 108 KiB |
@ -40,52 +40,52 @@ We used the following methodology to derive these network endpoints:
|
||||
|
||||
| **Destination** | **Protocol** | **Description** |
|
||||
| --- | --- | --- |
|
||||
|*.aria.microsoft.com* | HTTPS | Office Telemetry
|
||||
|*.dl.delivery.mp.microsoft.com* | HTTP | Enables connections to Windows Update.
|
||||
|*.download.windowsupdate.com* | HTTP | Used to download operating system patches and updates.
|
||||
|*.g.akamai.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use.
|
||||
|*.msn.com* |TLSv1.2/HTTPS | Windows Spotlight related traffic
|
||||
|*.Skype.com | HTTP/HTTPS | Skype related traffic
|
||||
|*.smartscreen.microsoft.com* | HTTPS | Windows Defender Smartscreen related traffic
|
||||
|*.telecommand.telemetry.microsoft.com* | HTTPS | Used by Windows Error Reporting.
|
||||
|*cdn.onenote.net* | HTTP | OneNote related traffic
|
||||
|*displaycatalog.mp.microsoft.com* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|*emdl.ws.microsoft.com* | HTTP | Windows Update related traffic
|
||||
|*geo-prod.do.dsp.mp.microsoft.com* |TLSv1.2/HTTPS | Enables connections to Windows Update.
|
||||
|*hwcdn.net* | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates.
|
||||
|*img-prod-cms-rt-microsoft-com.akamaized.net* | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
|
||||
|*maps.windows.com* | HTTPS | Related to Maps application.
|
||||
|*msedge.net* | HTTPS | Used by OfficeHub to get the metadata of Office apps.
|
||||
|*nexusrules.officeapps.live.com* | HTTPS | Office Telemetry
|
||||
|*photos.microsoft.com* | HTTPS | Photos App related traffic
|
||||
|*prod.do.dsp.mp.microsoft.com* |TLSv1.2/HTTPS | Used for Windows Update downloads of apps and OS updates.
|
||||
|*wac.phicdn.net* | HTTP | Windows Update related traffic
|
||||
|*windowsupdate.com* | HTTP | Windows Update related traffic
|
||||
|*wns.windows.com* | HTTPS, TLSv1.2 | Used for the Windows Push Notification Services (WNS).
|
||||
|*wpc.v0cdn.net* | | Windows Telemetry related traffic
|
||||
|\*.aria.microsoft.com\* | HTTPS | Office Telemetry
|
||||
|\*.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update.
|
||||
|\*.download.windowsupdate.com\* | HTTP | Used to download operating system patches and updates.
|
||||
|\*.g.akamai.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use.
|
||||
|\*.msn.com\* |TLSv1.2/HTTPS | Windows Spotlight related traffic
|
||||
|\*.Skype.com | HTTP/HTTPS | Skype related traffic
|
||||
|\*.smartscreen.microsoft.com\* | HTTPS | Windows Defender Smartscreen related traffic
|
||||
|\*.telecommand.telemetry.microsoft.com\* | HTTPS | Used by Windows Error Reporting.
|
||||
|\*cdn.onenote.net* | HTTP | OneNote related traffic
|
||||
|\*displaycatalog.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|\*emdl.ws.microsoft.com\* | HTTP | Windows Update related traffic
|
||||
|\*geo-prod.do.dsp.mp.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update.
|
||||
|\*hwcdn.net* | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates.
|
||||
|\*img-prod-cms-rt-microsoft-com.akamaized.net* | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
|
||||
|\*maps.windows.com\* | HTTPS | Related to Maps application.
|
||||
|\*msedge.net* | HTTPS | Used by OfficeHub to get the metadata of Office apps.
|
||||
|\*nexusrules.officeapps.live.com\* | HTTPS | Office Telemetry
|
||||
|\*photos.microsoft.com\* | HTTPS | Photos App related traffic
|
||||
|\*prod.do.dsp.mp.microsoft.com\* |TLSv1.2/HTTPS | Used for Windows Update downloads of apps and OS updates.
|
||||
|\*wac.phicdn.net* | HTTP | Windows Update related traffic
|
||||
|\*windowsupdate.com\* | HTTP | Windows Update related traffic
|
||||
|\*wns.windows.com\* | HTTPS, TLSv1.2 | Used for the Windows Push Notification Services (WNS).
|
||||
|\*wpc.v0cdn.net* | | Windows Telemetry related traffic
|
||||
|auth.gfx.ms/16.000.27934.1/OldConvergedLogin_PCore.js | | MSA related
|
||||
|evoke-windowsservices-tas.msedge* | HTTPS | The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|fe2.update.microsoft.com* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
|
||||
|fe3.*.mp.microsoft.com.* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
|
||||
|fe2.update.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
|
||||
|fe3.\*.mp.microsoft.com.\* |TLSv1.2/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
|
||||
|fs.microsoft.com | | Font Streaming (in ENT traffic)
|
||||
|g.live.com* | HTTPS | Used by OneDrive
|
||||
|g.live.com\* | HTTPS | Used by OneDrive
|
||||
|iriscoremetadataprod.blob.core.windows.net | HTTPS | Windows Telemetry
|
||||
|mscrl.micorosoft.com | | Certificate Revocation List related traffic.
|
||||
|ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities.
|
||||
|mscrl.microsoft.com | | Certificate Revocation List related traffic.
|
||||
|ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities.
|
||||
|officeclient.microsoft.com | HTTPS | Office related traffic.
|
||||
|oneclient.sfx.ms* | HTTPS | Used by OneDrive for Business to download and verify app updates.
|
||||
|purchase.mp.microsoft.com* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|query.prod.cms.rt.microsoft.com* | HTTPS | Used to retrieve Windows Spotlight metadata.
|
||||
|ris.api.iris.microsoft.com* |TLSv1.2/HTTPS | Used to retrieve Windows Spotlight metadata.
|
||||
|purchase.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|query.prod.cms.rt.microsoft.com\* | HTTPS | Used to retrieve Windows Spotlight metadata.
|
||||
|ris.api.iris.microsoft.com\* |TLSv1.2/HTTPS | Used to retrieve Windows Spotlight metadata.
|
||||
|ris-prod-atm.trafficmanager.net | HTTPS | Azure traffic manager
|
||||
|settings.data.microsoft.com* | HTTPS | Used for Windows apps to dynamically update their configuration.
|
||||
|settings-win.data.microsoft.com* | HTTPS | Used for Windows apps to dynamically update their configuration.
|
||||
|sls.update.microsoft.com* |TLSv1.2/HTTPS | Enables connections to Windows Update.
|
||||
|store*.dsx.mp.microsoft.com* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|storecatalogrevocation.storequality.microsoft.com* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store.
|
||||
|store-images.s-microsoft.com* | HTTP | Used to get images that are used for Microsoft Store suggestions.
|
||||
|tile-service.weather.microsoft.com* | HTTP | Used to download updates to the Weather app Live Tile.
|
||||
|tsfe.trafficshaping.dsp.mp.microsoft.com* |TLSv1.2 | Used for content regulation.
|
||||
|settings.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration.
|
||||
|settings-win.data.microsoft.com\* | HTTPS | Used for Windows apps to dynamically update their configuration.
|
||||
|sls.update.microsoft.com\* |TLSv1.2/HTTPS | Enables connections to Windows Update.
|
||||
|store*.dsx.mp.microsoft.com\* | HTTPS | Used to communicate with Microsoft Store.
|
||||
|storecatalogrevocation.storequality.microsoft.com\* | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store.
|
||||
|store-images.s-microsoft.com\* | HTTP | Used to get images that are used for Microsoft Store suggestions.
|
||||
|tile-service.weather.microsoft.com\* | HTTP | Used to download updates to the Weather app Live Tile.
|
||||
|tsfe.trafficshaping.dsp.mp.microsoft.com\* |TLSv1.2 | Used for content regulation.
|
||||
|v10.events.data.microsoft.com | HTTPS | Diagnostic Data
|
||||
|wdcp.microsoft.* |TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled.
|
||||
|wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com | HTTPS | Windows Defender related traffic.
|
||||
@ -111,7 +111,7 @@ We used the following methodology to derive these network endpoints:
|
||||
| ipv4.login.msa.akadns6.net | HTTPS | Used for Microsoft accounts to sign in. |
|
||||
| location-inference-westus.cloudapp.net | HTTPS | Used for location data. |
|
||||
| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
|
||||
| ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. |
|
||||
| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities. |
|
||||
| ris.api.iris.microsoft.com.akadns.net | HTTPS | Used to retrieve Windows Spotlight metadata. |
|
||||
| tile-service.weather.microsoft.com/* | HTTP | Used to download updates to the Weather app Live Tile. |
|
||||
| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation. |
|
||||
@ -127,10 +127,10 @@ We used the following methodology to derive these network endpoints:
|
||||
| *.g.akamaiedge.net | HTTPS | Used to check for updates to maps that have been downloaded for offline use. |
|
||||
| *.s-msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
|
||||
| *.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
|
||||
| *.tlu.dl.delivery.mp.microsoft.com* | HTTP | Enables connections to Windows Update. |
|
||||
| *.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
|
||||
| *.tlu.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update. |
|
||||
| *.windowsupdate.com\* | HTTP | Enables connections to Windows Update. |
|
||||
| *geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
|
||||
| au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
|
||||
| au.download.windowsupdate.com\* | HTTP | Enables connections to Windows Update. |
|
||||
| cdn.onenote.net/livetile/* | HTTPS | Used for OneNote Live Tile. |
|
||||
| client-office365-tas.msedge.net/* | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
|
||||
| config.edge.skype.com/* | HTTPS | Used to retrieve Skype configuration values. |
|
||||
@ -151,7 +151,7 @@ We used the following methodology to derive these network endpoints:
|
||||
| maps.windows.com/windows-app-web-link | HTTPS | Link to Maps application |
|
||||
| modern.watson.data.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
|
||||
| ocos-office365-s2s.msedge.net/* | HTTPS | Used to connect to the Office 365 portal's shared infrastructure. |
|
||||
| ocsp.digicert.com* | HTTP | CRL and OCSP checks to the issuing certificate authorities. |
|
||||
| ocsp.digicert.com\* | HTTP | CRL and OCSP checks to the issuing certificate authorities. |
|
||||
| oneclient.sfx.ms/* | HTTPS | Used by OneDrive for Business to download and verify app updates. |
|
||||
| settings-win.data.microsoft.com/settings/* | HTTPS | Used as a way for apps to dynamically update their configuration. |
|
||||
| sls.update.microsoft.com/* | HTTPS | Enables connections to Windows Update. |
|
||||
|
||||
@ -43,6 +43,14 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will
|
||||
|
||||
To enforce processing of the group policy, you can run ```gpupdate /force```.
|
||||
|
||||
### Enable Windows Defender Credential Guard by using Intune
|
||||
|
||||
1. From **Home** click **Microsoft Intune**
|
||||
2. Click **Device configuration**
|
||||
3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**.
|
||||
|
||||
> [!NOTE]
|
||||
> It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock.
|
||||
|
||||
### Enable Windows Defender Credential Guard by using the registry
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -8,8 +8,8 @@ ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -35,9 +35,9 @@ On-premises certificate-based deployments of Windows Hello for Business needs th
|
||||
|
||||
## Enable Windows Hello for Business Group Policy
|
||||
|
||||
The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled.
|
||||
The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users.
|
||||
|
||||
You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence.
|
||||
If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business.
|
||||
|
||||
## Use certificate for on-premises authentication
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -8,8 +8,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -187,7 +187,7 @@ Joining a device is an extension to registering a device. This means, it provide
|
||||
|
||||
[Return to Top](hello-how-it-works-technology.md)
|
||||
## Key Trust
|
||||
The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The certificate trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers.
|
||||
The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The key trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers.
|
||||
|
||||
### Related topics
|
||||
[Certificate Trust](#certificate-trust), [Deployment Type](#deployment-type), [Hybrid Azure AD Joined](#hybrid-azure-ad-joined), [Hybrid Deployment](#hybrid-deployment), [On-premises Deployment](#on-premises-deployment), [Trust Type](#trust-type)
|
||||
|
||||
@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -82,7 +82,7 @@ Organizations using older directory synchronization technology, such as DirSync
|
||||
<br>
|
||||
|
||||
## Federation ##
|
||||
Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices.
|
||||
Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesn’t support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices.
|
||||
|
||||
The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016)
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
---
|
||||
---
|
||||
title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business)
|
||||
description: Provisioning for Hybrid Windows Hello for Business Deployments
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -18,7 +18,7 @@ ms.date: 08/19/2018
|
||||
# Hybrid Windows Hello for Business Provisioning
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 10, version 1703 or later
|
||||
- Hybrid deployment
|
||||
- Certificate trust
|
||||
|
||||
@ -65,7 +65,7 @@ After a successful key registration, Windows creates a certificate request using
|
||||
|
||||
The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority.
|
||||
|
||||
The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center.
|
||||
The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center.
|
||||
|
||||
<br><br>
|
||||
|
||||
@ -77,5 +77,5 @@ The certificate authority validates the certificate was signed by the registrati
|
||||
3. [New Installation Baseline](hello-hybrid-cert-new-install.md)
|
||||
4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md)
|
||||
6. Sign-in and Provision(*You are here*)
|
||||
6. Sign-in and Provision(*You are here*)
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
---
|
||||
---
|
||||
title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business)
|
||||
description: Provisioning for Hybrid Windows Hello for Business Deployments
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -18,7 +18,7 @@ ms.date: 08/20/2018
|
||||
# Hybrid Windows Hello for Business Provisioning
|
||||
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- Windows 10, version 1703 or later
|
||||
- Hybrid deployment
|
||||
- Key trust
|
||||
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -8,8 +8,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
@ -50,7 +50,7 @@ The table shows the minimum requirements for each deployment. For key trust in a
|
||||
| Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**<br> *Minimum:* Windows 10, version 1703<br> *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).</br>**Azure AD Joined:**<br> Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later |
|
||||
| Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema |
|
||||
| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level |
|
||||
| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
|
||||
| N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),<br> and</br>Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service |
|
||||
| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or</br>AD FS w/Azure MFA adapter, or</br>AD FS w/Azure MFA Server adapter, or</br>AD FS w/3rd Party MFA Adapter |
|
||||
@ -67,7 +67,7 @@ The table shows the minimum requirements for each deployment.
|
||||
| Windows 10, version 1703 or later | Windows 10, version 1703 or later |
|
||||
| Windows Server 2016 Schema | Windows Server 2016 Schema|
|
||||
| Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level |
|
||||
| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||
| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers |
|
||||
| Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority |
|
||||
| Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) |
|
||||
| AD FS with Azure MFA Server, or</br>AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or</br>AD FS with 3rd Party MFA Adapter |
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -9,7 +9,7 @@ ms.pagetype: security, mobile
|
||||
author: DaniHalfin
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: conceptual
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -8,8 +8,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, mobile
|
||||
audience: ITPro
|
||||
author: mikestephens-MS
|
||||
ms.author: mstephen
|
||||
author: mapalko
|
||||
ms.author: mapalko
|
||||
manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
|
||||
@ -89,7 +89,7 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r
|
||||
|
||||
The Remote Desktop client device:
|
||||
|
||||
- Must be running at least Windows 10, version 1703 to be able to supply credentials.
|
||||
- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine.
|
||||
- Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host.
|
||||
- Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard.
|
||||
- Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk.
|
||||
|
||||
@ -228,6 +228,7 @@
|
||||
####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md)
|
||||
###### [Onboard servers](microsoft-defender-atp/configure-server-endpoints.md)
|
||||
###### [Onboard non-Windows machines](microsoft-defender-atp/configure-endpoints-non-windows.md)
|
||||
###### [Onboard machines without Internet access](microsoft-defender-atp/onboard-offline-machines.md)
|
||||
###### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md)
|
||||
###### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md)
|
||||
###### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md)
|
||||
@ -345,6 +346,10 @@
|
||||
###### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md)
|
||||
###### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md)
|
||||
|
||||
##### Interoperability
|
||||
###### [Partner applications](windows-defender-atp/partner-applications.md)
|
||||
|
||||
|
||||
##### Role-based access control
|
||||
###### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
####### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
@ -389,7 +394,7 @@
|
||||
#####Rules
|
||||
###### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md)
|
||||
###### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md)
|
||||
###### [Manage allowed/blocked lists](microsoft-defender-atp/manage-allowed-blocked-list.md)
|
||||
###### [Manage indicators](microsoft-defender-atp/manage-indicators.md)
|
||||
###### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md)
|
||||
###### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md)
|
||||
|
||||
|
||||
@ -132,7 +132,7 @@ This event is generated only on domain controllers.
|
||||
| 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.<br>Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/library/cc223991.aspx).<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. |
|
||||
| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Only evaluated if SID Filtering is used.<br>Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts.<br>Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.<br>Only evaluated if SID Filtering is used.<br>Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. |
|
||||
| 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/library/cc223782.aspx).<br>Only evaluated on TRUST\_TYPE\_MIT |
|
||||
| 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section 3.3.5.7.5.<br>Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. |
|
||||
| 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.<br>Evaluated only on Windows Server 2016<br>Evaluated only if SID Filtering is used.<br>Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.<br>Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. |
|
||||
|
||||
@ -17,37 +17,48 @@ ms.date: 04/19/2017
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
This event is logged if the Windows Filtering Platform has blocked a bind to a local port.
|
||||
|
||||
There is no example of this event in this document.
|
||||
<img src="images/event-5159.png" alt="Event 5159 illustration" width="491" height="466" hspace="10" align="left" />
|
||||
|
||||
***Subcategory:*** [Audit Filtering Platform Connection](audit-filtering-platform-connection.md)
|
||||
|
||||
***Event Schema:***
|
||||
***Event Description:***
|
||||
|
||||
*The Windows Filtering Platform has blocked a bind to a local port.*
|
||||
This event is logged if the Windows Filtering Platform has blocked a bind to a local port.
|
||||
|
||||
*Application Information:*
|
||||
<br clear="all">
|
||||
|
||||
> *Process ID:%1*
|
||||
>
|
||||
> *Application Name:%2*
|
||||
***Event XML:***
|
||||
```
|
||||
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
|
||||
- <System>
|
||||
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
|
||||
<EventID>5159</EventID>
|
||||
<Version>0</Version>
|
||||
<Level>0</Level>
|
||||
<Task>12810</Task>
|
||||
<Opcode>0</Opcode>
|
||||
<Keywords>0x8010000000000000</Keywords>
|
||||
<TimeCreated SystemTime="2019-04-19T07:36:55.955388300Z" />
|
||||
<EventRecordID>44097</EventRecordID>
|
||||
<Correlation />
|
||||
<Execution ProcessID="4" ThreadID="6480" />
|
||||
<Channel>Security</Channel>
|
||||
<Computer>DC01.contoso.local</Computer>
|
||||
<Security />
|
||||
</System>
|
||||
- <EventData>
|
||||
<Data Name="ProcessId">7924</Data>
|
||||
<Data Name="Application">\device\harddiskvolume2\users\test\desktop\netcat\nc.exe</Data>
|
||||
<Data Name="SourceAddress">0.0.0.0</Data>
|
||||
<Data Name="SourcePort">5555</Data>
|
||||
<Data Name="Protocol">6</Data>
|
||||
<Data Name="FilterRTID">84614</Data>
|
||||
<Data Name="LayerName">%%14608</Data>
|
||||
<Data Name="LayerRTID">36</Data>
|
||||
</EventData>
|
||||
</Event>
|
||||
|
||||
*Network Information:*
|
||||
|
||||
> *Source Address:%3*
|
||||
>
|
||||
> *Source Port:%4*
|
||||
>
|
||||
> *Protocol:%5*
|
||||
|
||||
*Filter Information:*
|
||||
|
||||
> *Filter Run-Time ID:%6*
|
||||
>
|
||||
> *Layer Name:%7*
|
||||
>
|
||||
> *Layer Run-Time ID:%8*
|
||||
```
|
||||
|
||||
***Required Server Roles:*** None.
|
||||
|
||||
@ -55,6 +66,76 @@ There is no example of this event in this document.
|
||||
|
||||
***Event Versions:*** 0.
|
||||
|
||||
***Field Descriptions:***
|
||||
|
||||
**Application Information**:
|
||||
|
||||
- **Process ID** \[Type = Pointer\]: hexadecimal Process ID of the process which was permitted to bind to the local port. Process ID (PID) is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column):
|
||||
|
||||
<img src="images/task-manager.png" alt="Task manager illustration" width="585" height="375" />
|
||||
|
||||
If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager.
|
||||
|
||||
You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**.
|
||||
|
||||
<!-- -->
|
||||
|
||||
- **Application Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the process.
|
||||
|
||||
Logical disk is displayed in format \\device\\harddiskvolume\#. You can get all local volume numbers by using **diskpart** utility. The command to get volume numbers using diskpart is “**list volume”**:
|
||||
|
||||
<img src="images/diskpart.png" alt="DiskPart illustration" width="786" height="246" />
|
||||
|
||||
**Network Information:**
|
||||
|
||||
- **Source Address** \[Type = UnicodeString\]**:** the local IP address of the computer running the application.
|
||||
|
||||
- IPv4 Address
|
||||
|
||||
- IPv6 Address
|
||||
|
||||
- :: - all IP addresses in IPv6 format
|
||||
|
||||
- 0.0.0.0 - all IP addresses in IPv4 format
|
||||
|
||||
- 127.0.0.1 , ::1 - localhost
|
||||
|
||||
- **Source Port** \[Type = UnicodeString\]**:** the port number used by the application.
|
||||
|
||||
- **Protocol** \[Type = UInt32\]: the protocol number being used.
|
||||
|
||||
| Service | Protocol Number |
|
||||
|----------------------------------------------------|-----------------|
|
||||
| Internet Control Message Protocol (ICMP) | 1 |
|
||||
| Transmission Control Protocol (TCP) | 6 |
|
||||
| User Datagram Protocol (UDP) | 17 |
|
||||
| General Routing Encapsulation (PPTP data over GRE) | 47 |
|
||||
| Authentication Header (AH) IPSec | 51 |
|
||||
| Encapsulation Security Payload (ESP) IPSec | 50 |
|
||||
| Exterior Gateway Protocol (EGP) | 8 |
|
||||
| Gateway-Gateway Protocol (GGP) | 3 |
|
||||
| Host Monitoring Protocol (HMP) | 20 |
|
||||
| Internet Group Management Protocol (IGMP) | 88 |
|
||||
| MIT Remote Virtual Disk (RVD) | 66 |
|
||||
| OSPF Open Shortest Path First | 89 |
|
||||
| PARC Universal Packet Protocol (PUP) | 12 |
|
||||
| Reliable Datagram Protocol (RDP) | 27 |
|
||||
| Reservation Protocol (RSVP) QoS | 46 |
|
||||
|
||||
**Filter Information:**
|
||||
|
||||
- **Filter Run-Time ID** \[Type = UInt64\]: unique filter ID which blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding by an application, and if this application doesn’t match any filters, you will get value 0 in this field.
|
||||
|
||||
To find specific Windows Filtering Platform filter by ID you need to execute the following command: **netsh wfp show filters**. As a result of this command, **filters.xml** file will be generated. You need to open this file and find the specific substring with the required filter ID (**<filterId>**)**,** for example:
|
||||
|
||||
<img src="images/filters-xml-file.png" alt="Filters.xml file illustration" width="840" height="176" />
|
||||
|
||||
- **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name.
|
||||
|
||||
- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find specific Windows Filtering Platform layer ID you need to execute the following command: **netsh wfp show state**. As result of this command **wfpstate.xml** file will be generated. You need to open this file and find specific substring with required layer ID (**<layerId>**)**,** for example:
|
||||
|
||||
<img src="images/wfpstate-xml.png" alt="Wfpstate xml illustration" width="1563" height="780" />
|
||||
|
||||
## Security Monitoring Recommendations
|
||||
|
||||
- There is no recommendation for this event in this document.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
@ -232,6 +232,7 @@
|
||||
###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
##### [Onboard servers](configure-server-endpoints.md)
|
||||
##### [Onboard non-Windows machines](configure-endpoints-non-windows.md)
|
||||
##### [Onboard machines without Internet access](onboard-offline-machines.md)
|
||||
##### [Run a detection test on a newly onboarded machine](run-detection-test.md)
|
||||
##### [Run simulated attacks on machines](attack-simulations.md)
|
||||
##### [Configure proxy and Internet connectivity settings](configure-proxy-internet.md)
|
||||
@ -343,6 +344,10 @@
|
||||
##### [Threat protection reports](threat-protection-reports.md)
|
||||
##### [Machine health and compliance reports](machine-reports.md)
|
||||
|
||||
|
||||
#### Interoperability
|
||||
##### [Partner applications](partner-applications.md)
|
||||
|
||||
#### Role-based access control
|
||||
##### [Manage portal access using RBAC](rbac.md)
|
||||
###### [Create and manage roles](user-roles.md)
|
||||
@ -379,7 +384,7 @@
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md)
|
||||
##### [Manage allowed/blocked lists](manage-allowed-blocked-list.md)
|
||||
##### [Manage indicators](manage-indicators.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions.md)
|
||||
|
||||
|
||||
@ -19,12 +19,9 @@ ms.topic: article
|
||||
# Add or Remove Machine Tags API
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Adds or remove tag to a specific machine.
|
||||
This API adds or remove tag to a specific machine.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -94,8 +94,7 @@ To receive contextual machine integration in Office 365 Threat Intelligence, you
|
||||
This feature is currently on public preview. When you enable this feature, you'll receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
|
||||
>[!NOTE]
|
||||
>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later.
|
||||
|
||||
>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions.
|
||||
|
||||
|
||||
## Microsoft Cloud App Security
|
||||
|
||||
@ -20,9 +20,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Represents an alert entity in Microsoft Defender ATP.
|
||||
Represents an alert entity in Windows Defender ATP.
|
||||
|
||||
# Methods
|
||||
Method|Return Type |Description
|
||||
|
||||
@ -14,19 +14,15 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/08/2017
|
||||
|
||||
---
|
||||
|
||||
# Collect investigation package API
|
||||
**Applies to:**
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Collect investigation package from a machine.
|
||||
|
||||
[!include[Machine actions note](machineactionsnote.md)]
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.date: 04/11/2019
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease<EFBFBD>information](prerelease.md)]
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>[!NOTE]
|
||||
> Secure score is now part of Threat & Vulnerability Management as Configuration score. We’ll keep the secure score page available for a few weeks. View the [Secure score](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection) page.
|
||||
|
||||
@ -20,7 +20,7 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease<EFBFBD>information](prerelease.md)]
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section guides you through the steps you need to take to configure Threat & Vulnerability Management's integration with Microsoft Intune or Microsoft System Center Configuration Manager (SCCM) for a seamless collaboration of issue remediation.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 02/28/2019
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease<EFBFBD>information](prerelease.md)]
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need to have a valid Premier customer service and support account. However, Premier charges will not be incurred during the preview.
|
||||
|
||||
@ -14,21 +14,18 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 12/08/2017
|
||||
---
|
||||
|
||||
# Create alert from event API
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity.
|
||||
|
||||
## Permissions
|
||||
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
@ -42,6 +39,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
|
||||
>- The user needs to have access to the machine associated with the alert, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/alerts/CreateAlertByReference
|
||||
```
|
||||
@ -54,6 +52,7 @@ Authorization | String | Bearer {token}. **Required**.
|
||||
Content-Type | String | application/json. **Required**.
|
||||
|
||||
## Request body
|
||||
|
||||
In the request body, supply the following values (all are required):
|
||||
|
||||
Property | Type | Description
|
||||
@ -67,10 +66,9 @@ eventTime | DateTime(UTC) | The time of the event, as obtained from the advanced
|
||||
reportId | String | The reportId, as obtained from the advanced query. **Required**.
|
||||
category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 OK, and a new [alert](alerts.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found.
|
||||
|
||||
If successful, this method returns 200 OK, and a new [alert](alerts.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found.
|
||||
|
||||
## Example
|
||||
|
||||
|
||||
@ -36,12 +36,12 @@ Information collected includes file data (such as file names, sizes, and hashes)
|
||||
|
||||
Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and [Microsoft Trust Center policies](https://go.microsoft.com/fwlink/?linkid=827578).
|
||||
|
||||
Microsoft uses this data to:
|
||||
This data enables Windows Defender ATP to:
|
||||
- Proactively identify indicators of attack (IOAs) in your organization
|
||||
- Generate alerts if a possible attack was detected
|
||||
- Provide your security operations with a view into machines, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network.
|
||||
|
||||
Microsoft does not use your data for advertising or for any other purpose other than providing you the service.
|
||||
Microsoft does not use your data for advertising.
|
||||
|
||||
## Data protection and encryption
|
||||
The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
|
||||
@ -21,10 +21,9 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>[!Note]
|
||||
> Currently this API is supported only for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information)
|
||||
> Currently this API is only supported for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information)
|
||||
|
||||
|
||||
- Deletes an Indicator entity by ID.
|
||||
|
||||
@ -14,18 +14,15 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Use Microsoft Defender ATP APIs
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP on behalf of a user.
|
||||
|
||||
If you need programmatic access Microsoft Defender ATP without a user, refer to [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md).
|
||||
|
||||
@ -14,20 +14,19 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Create an app to access Microsoft Defender ATP without a user
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP without a user.
|
||||
|
||||
If you need programmatic access Microsoft Defender ATP on behalf of a user, see [Get access wtih user context](exposed-apis-create-app-nativeapp.md)
|
||||
If you need programmatic access Microsoft Defender ATP on behalf of a user, see [Get access with user context](exposed-apis-create-app-nativeapp.md)
|
||||
|
||||
If you are not sure which access you need, see [Get started](apis-intro.md).
|
||||
|
||||
@ -56,7 +55,6 @@ This page explains how to create an AAD application, get an access token to Micr
|
||||
- **Application type:** Web app / API
|
||||
- **Redirect URI:** `https://127.0.0.1`
|
||||
|
||||
|
||||
4. Click **Settings** > **Required permissions** > **Add**.
|
||||
|
||||
|
||||
|
||||
@ -21,8 +21,6 @@ ms.date: 09/24/2018
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
Full scenario using multiple APIs from Microsoft Defender ATP.
|
||||
|
||||
|
||||
@ -14,20 +14,19 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/15/2018
|
||||
---
|
||||
|
||||
# OData queries with Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/)
|
||||
If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/)
|
||||
|
||||
- Not all properties are filterable.
|
||||
Not all properties are filterable.
|
||||
|
||||
### Properties that supports $filter:
|
||||
## Properties that supports $filter:
|
||||
|
||||
- [Alert](alerts.md): Id, IncidentId, AlertCreationTime, Status, Severity and Category.
|
||||
- [Machine](machine.md): Id, ComputerDnsName, LastSeen, LastIpAddress, HealthStatus, OsPlatform, RiskScore, MachineTags and RbacGroupId.
|
||||
|
||||
@ -20,7 +20,6 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Represent a file entity in Microsoft Defender ATP.
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user