mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-07-03 03:03:43 +00:00
Merge pull request #4442 from MicrosoftDocs/master
Publish 12/18/2020, 10:30 AM PT
This commit is contained in:
Jeff Borsecnik
GitHub
@ -1,24 +1,29 @@
|
||||
---
|
||||
title: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal
|
||||
description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal
|
||||
description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new portal
|
||||
ms.author: dansimp
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: lomayor
|
||||
ms.date: 01/17/2018
|
||||
ms.date: 12/18/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal
|
||||
|
||||
Go to your Azure AD Blade, select the Mobility (MDM and MAM) and there should be the Microsoft Intune "App" Visible, select the Microsoft Intune and configure the Blade
|
||||
> [!NOTE]
|
||||
> Microsoft Intune portal can be accessed at the following link: [https://endpoint.microsoft.com](https://endpoint.microsoft.com).
|
||||
|
||||
1. Go to your Azure AD Blade.
|
||||
2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app.
|
||||
3. Select **Microsoft Intune** and configure the blade.
|
||||
|
||||
|
||||
|
||||
Configure the Blade
|
||||
Configure the blade
|
||||
|
||||
|
||||
|
||||
Select all for allow all users to enroll a Device and make it Intune ready, or Some, then you can add a Group of Users.
|
||||
You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users).
|
||||
|
||||
@ -3,9 +3,9 @@
|
||||
## [BitLocker](bitlocker\bitlocker-overview.md)
|
||||
### [Overview of BitLocker Device Encryption in Windows 10](bitlocker\bitlocker-device-encryption-overview-windows-10.md)
|
||||
### [BitLocker frequently asked questions (FAQ)](bitlocker\bitlocker-frequently-asked-questions.md)
|
||||
#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.md)
|
||||
#### [Overview and requirements](bitlocker\bitlocker-overview-and-requirements-faq.yml)
|
||||
#### [Upgrading](bitlocker\bitlocker-upgrading-faq.md)
|
||||
#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.md)
|
||||
#### [Deployment and administration](bitlocker\bitlocker-deployment-and-administration-faq.yml)
|
||||
#### [Key management](bitlocker\bitlocker-key-management-faq.md)
|
||||
#### [BitLocker To Go](bitlocker\bitlocker-to-go-faq.md)
|
||||
#### [Active Directory Domain Services](bitlocker\bitlocker-and-adds-faq.md)
|
||||
|
||||
@ -1,101 +0,0 @@
|
||||
---
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker frequently asked questions (FAQ)
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
## Can BitLocker deployment be automated in an enterprise environment?
|
||||
|
||||
Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps).
|
||||
|
||||
## Can BitLocker encrypt more than just the operating system drive?
|
||||
|
||||
Yes.
|
||||
|
||||
## Is there a noticeable performance impact when BitLocker is enabled on a computer?
|
||||
|
||||
Generally it imposes a single-digit percentage performance overhead.
|
||||
|
||||
## How long will initial encryption take when BitLocker is turned on?
|
||||
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
|
||||
You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
|
||||
|
||||
## What happens if the computer is turned off during encryption or decryption?
|
||||
|
||||
If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable.
|
||||
|
||||
## Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data?
|
||||
|
||||
No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive.
|
||||
|
||||
## How can I prevent users on a network from storing data on an unencrypted drive?
|
||||
|
||||
You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only.
|
||||
|
||||
## What is Used Disk Space Only encryption?
|
||||
|
||||
BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption).
|
||||
|
||||
## What system changes would cause the integrity check on my operating system drive to fail?
|
||||
|
||||
The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive:
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Installing a new motherboard with a new TPM.
|
||||
- Turning off, disabling, or clearing the TPM.
|
||||
- Changing any boot configuration settings.
|
||||
- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data.
|
||||
|
||||
## What causes BitLocker to start into recovery mode when attempting to start the operating system drive?
|
||||
|
||||
Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
|
||||
For example:
|
||||
|
||||
- Changing the BIOS boot order to boot another drive in advance of the hard drive.
|
||||
- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
|
||||
In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
|
||||
The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed.
|
||||
|
||||
## What can prevent BitLocker from binding to PCR 7?
|
||||
|
||||
BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
|
||||
## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive?
|
||||
|
||||
Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
|
||||
## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer?
|
||||
|
||||
Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key.
|
||||
|
||||
## Why is "Turn BitLocker on" not available when I right-click a drive?
|
||||
Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted.
|
||||
|
||||
## What type of disk configurations are supported by BitLocker?
|
||||
Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported.
|
||||
|
||||
|
||||
@ -0,0 +1,97 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker deployment and administration FAQ (Windows 10)
|
||||
description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?"
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker frequently asked questions (FAQ)
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: Can BitLocker deployment be automated in an enterprise environment?
|
||||
answer: |
|
||||
Yes, you can automate the deployment and configuration of BitLocker and the TPM using either WMI or Windows PowerShell scripts. How you choose to implement the scripts depends on your environment. You can also use Manage-bde.exe to locally or remotely configure BitLocker. For more info about writing scripts that use the BitLocker WMI providers, see [BitLocker Drive Encryption Provider](https://go.microsoft.com/fwlink/p/?LinkId=80600). For more info about using Windows PowerShell cmdlets with BitLocker Drive Encryption, see [BitLocker Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/bitlocker/index?view=win10-ps).
|
||||
|
||||
- question: Can BitLocker encrypt more than just the operating system drive?
|
||||
answer: Yes.
|
||||
|
||||
- question: Is there a noticeable performance impact when BitLocker is enabled on a computer?
|
||||
answer: Generally it imposes a single-digit percentage performance overhead.
|
||||
|
||||
- question: How long will initial encryption take when BitLocker is turned on?
|
||||
answer: |
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
|
||||
You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
|
||||
|
||||
- question: What happens if the computer is turned off during encryption or decryption?
|
||||
answer: If the computer is turned off or goes into hibernation, the BitLocker encryption and decryption process will resume where it stopped the next time Windows starts. This is true even if the power is suddenly unavailable.
|
||||
|
||||
- question: Does BitLocker encrypt and decrypt the entire drive all at once when reading and writing data?
|
||||
answer: No, BitLocker does not encrypt and decrypt the entire drive when reading and writing data. The encrypted sectors in the BitLocker-protected drive are decrypted only as they are requested from system read operations. Blocks that are written to the drive are encrypted before the system writes them to the physical disk. No unencrypted data is ever stored on a BitLocker-protected drive.
|
||||
|
||||
- question: How can I prevent users on a network from storing data on an unencrypted drive?
|
||||
answer: |
|
||||
You can configure Group Policy settings to require that data drives be BitLocker-protected before a BitLocker-protected computer can write data to them. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
When these policy settings are enabled, the BitLocker-protected operating system will mount any data drives that are not protected by BitLocker as read-only.
|
||||
|
||||
- question: What is Used Disk Space Only encryption?
|
||||
answer: |
|
||||
BitLocker in Windows 10 lets users choose to encrypt just their data. Although it's not the most secure way to encrypt a drive, this option can reduce encryption time by more than 99 percent, depending on how much data that needs to be encrypted. For more information, see [Used Disk Space Only encryption](bitlocker-device-encryption-overview-windows-10.md#used-disk-space-only-encryption).
|
||||
|
||||
- question: What system changes would cause the integrity check on my operating system drive to fail?
|
||||
answer: |
|
||||
The following types of system changes can cause an integrity check failure and prevent the TPM from releasing the BitLocker key to decrypt the protected operating system drive:
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Installing a new motherboard with a new TPM.
|
||||
- Turning off, disabling, or clearing the TPM.
|
||||
- Changing any boot configuration settings.
|
||||
- Changing the BIOS, UEFI firmware, master boot record, boot sector, boot manager, option ROM, or other early boot components or boot configuration data.
|
||||
|
||||
- question: What causes BitLocker to start into recovery mode when attempting to start the operating system drive?
|
||||
answer: |
|
||||
Because BitLocker is designed to protect your computer from numerous attacks, there are numerous reasons why BitLocker could start in recovery mode.
|
||||
For example:
|
||||
|
||||
- Changing the BIOS boot order to boot another drive in advance of the hard drive.
|
||||
- Adding or removing hardware, such as inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
|
||||
In BitLocker, recovery consists of decrypting a copy of the volume master key using either a recovery key stored on a USB flash drive or a cryptographic key derived from a recovery password.
|
||||
The TPM is not involved in any recovery scenarios, so recovery is still possible if the TPM fails boot component validation, malfunctions, or is removed.
|
||||
|
||||
- question: What can prevent BitLocker from binding to PCR 7?
|
||||
answer: BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
|
||||
- question: Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive?
|
||||
answer: Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
|
||||
- question: Can I access my BitLocker-protected drive if I insert the hard disk into a different computer?
|
||||
answer: Yes, if the drive is a data drive, you can unlock it from the **BitLocker Drive Encryption** Control Panel item just as you would any other data drive by using a password or smart card. If the data drive was configured for automatic unlock only, you will have to unlock it by using the recovery key. The encrypted hard disk can be unlocked by a data recovery agent (if one was configured) or it can be unlocked by using the recovery key.
|
||||
|
||||
- question: Why is "Turn BitLocker on" not available when I right-click a drive?
|
||||
answer: Some drives cannot be encrypted with BitLocker. Reasons a drive cannot be encrypted include insufficient disk size, an incompatible file system, if the drive is a dynamic disk, or a drive is designated as the system partition. By default, the system drive (or system partition) is hidden from display. However, if it is not created as a hidden drive when the operating system was installed due to a custom installation process, that drive might be displayed but cannot be encrypted.
|
||||
|
||||
- question: What type of disk configurations are supported by BitLocker?
|
||||
answer: Any number of internal, fixed data drives can be protected with BitLocker. On some versions ATA and SATA-based, direct-attached storage devices are also supported.
|
||||
|
||||
@ -25,9 +25,9 @@ ms.custom: bitlocker
|
||||
|
||||
This topic links to frequently asked questions about BitLocker. BitLocker is a data protection feature that encrypts drives on your computer to help prevent data theft or exposure. BitLocker-protected computers can also delete data more securely when they are decommissioned because it is much more difficult to recover deleted data from an encrypted drive than from a non-encrypted drive.
|
||||
|
||||
- [Overview and requirements](bitlocker-overview-and-requirements-faq.md)
|
||||
- [Overview and requirements](bitlocker-overview-and-requirements-faq.yml)
|
||||
- [Upgrading](bitlocker-upgrading-faq.md)
|
||||
- [Deployment and administration](bitlocker-deployment-and-administration-faq.md)
|
||||
- [Deployment and administration](bitlocker-deployment-and-administration-faq.yml)
|
||||
- [Key management](bitlocker-key-management-faq.md)
|
||||
- [BitLocker To Go](bitlocker-to-go-faq.md)
|
||||
- [Active Directory Domain Services (AD DS)](bitlocker-and-adds-faq.md)
|
||||
|
||||
@ -1,82 +0,0 @@
|
||||
---
|
||||
title: BitLocker overview and requirements FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Overview and Requirements FAQ
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
## How does BitLocker work?
|
||||
|
||||
**How BitLocker works with operating system drives**
|
||||
|
||||
You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data.
|
||||
|
||||
**How BitLocker works with fixed and removable data drives**
|
||||
|
||||
You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods.
|
||||
|
||||
## Does BitLocker support multifactor authentication?
|
||||
|
||||
Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection.
|
||||
|
||||
## What are the BitLocker hardware and software requirements?
|
||||
|
||||
For requirements, see [System requirements](bitlocker-overview.md#system-requirements).
|
||||
|
||||
> [!NOTE]
|
||||
> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker.
|
||||
|
||||
## Why are two partitions required? Why does the system drive have to be so large?
|
||||
|
||||
Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
|
||||
|
||||
## Which Trusted Platform Modules (TPMs) does BitLocker support?
|
||||
|
||||
BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device.
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
|
||||
> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
|
||||
|
||||
## How can I tell if a TPM is on my computer?
|
||||
|
||||
Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading.
|
||||
|
||||
## Can I use BitLocker on an operating system drive without a TPM?
|
||||
|
||||
Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide.
|
||||
To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.
|
||||
|
||||
## How do I obtain BIOS support for the TPM on my computer?
|
||||
|
||||
Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements:
|
||||
|
||||
- It is compliant with the TCG standards for a client computer.
|
||||
- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer.
|
||||
|
||||
## What credentials are required to use BitLocker?
|
||||
|
||||
To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives.
|
||||
|
||||
## What is the recommended boot order for computers that are going to be BitLocker-protected?
|
||||
|
||||
You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
|
||||
@ -0,0 +1,82 @@
|
||||
### YamlMime:FAQ
|
||||
metadata:
|
||||
title: BitLocker overview and requirements FAQ (Windows 10)
|
||||
description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker.
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
|
||||
title: BitLocker Overview and Requirements FAQ
|
||||
summary: |
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
|
||||
sections:
|
||||
- name: Ignored
|
||||
questions:
|
||||
- question: How does BitLocker work?
|
||||
answer: |
|
||||
**How BitLocker works with operating system drives**
|
||||
|
||||
You can use BitLocker to mitigate unauthorized data access on lost or stolen computers by encrypting all user files and system files on the operating system drive, including the swap files and hibernation files, and checking the integrity of early boot components and boot configuration data.
|
||||
|
||||
**How BitLocker works with fixed and removable data drives**
|
||||
|
||||
You can use BitLocker to encrypt the entire contents of a data drive. You can use Group Policy to require that BitLocker be enabled on a drive before the computer can write data to the drive. BitLocker can be configured with a variety of unlock methods for data drives, and a data drive supports multiple unlock methods.
|
||||
|
||||
- question: Does BitLocker support multifactor authentication?
|
||||
answer: Yes, BitLocker supports multifactor authentication for operating system drives. If you enable BitLocker on a computer that has a TPM version 1.2 or later, you can use additional forms of authentication with the TPM protection.
|
||||
|
||||
- question: What are the BitLocker hardware and software requirements?
|
||||
answer: |
|
||||
For requirements, see [System requirements](bitlocker-overview.md#system-requirements).
|
||||
|
||||
> [!NOTE]
|
||||
> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker.
|
||||
|
||||
- question: Why are two partitions required? Why does the system drive have to be so large?
|
||||
answer: Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
|
||||
|
||||
- question: Which Trusted Platform Modules (TPMs) does BitLocker support?
|
||||
answer: |
|
||||
BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device.
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
>
|
||||
> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI.
|
||||
|
||||
- question: How can I tell if a TPM is on my computer?
|
||||
answer: Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading.
|
||||
|
||||
- question: Can I use BitLocker on an operating system drive without a TPM?
|
||||
answer: |
|
||||
Yes, you can enable BitLocker on an operating system drive without a TPM version 1.2 or higher, if the BIOS or UEFI firmware has the ability to read from a USB flash drive in the boot environment. This is because BitLocker will not unlock the protected drive until BitLocker's own volume master key is first released by either the computer's TPM or by a USB flash drive containing the BitLocker startup key for that computer. However, computers without TPMs will not be able to use the system integrity verification that BitLocker can also provide.
|
||||
To help determine whether a computer can read from a USB device during the boot process, use the BitLocker system check as part of the BitLocker setup process. This system check performs tests to confirm that the computer can properly read from the USB devices at the appropriate time and that the computer meets other BitLocker requirements.
|
||||
|
||||
- question: How do I obtain BIOS support for the TPM on my computer?
|
||||
answer: |
|
||||
Contact the computer manufacturer to request a Trusted Computing Group (TCG)-compliant BIOS or UEFI boot firmware that meets the following requirements:
|
||||
|
||||
- It is compliant with the TCG standards for a client computer.
|
||||
- It has a secure update mechanism to help prevent a malicious BIOS or boot firmware from being installed on the computer.
|
||||
|
||||
- question: What credentials are required to use BitLocker?
|
||||
answer: To turn on, turn off, or change configurations of BitLocker on operating system and fixed data drives, membership in the local **Administrators** group is required. Standard users can turn on, turn off, or change configurations of BitLocker on removable data drives.
|
||||
|
||||
- question: What is the recommended boot order for computers that are going to be BitLocker-protected?
|
||||
answer: You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.
|
||||
|
||||
@ -29,7 +29,7 @@ ms.topic: conceptual
|
||||
|
||||
- [Defender for Endpoint](microsoft-defender-atp-android.md)
|
||||
|
||||
This topic describes deploying Defender for Endpoint for Android on Intune
|
||||
Learn how to deploy Defender for Endpoint for Android on Intune
|
||||
Company Portal enrolled devices. For more information about Intune device enrollment, see [Enroll your
|
||||
device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-company-portal).
|
||||
|
||||
@ -44,13 +44,13 @@ device](https://docs.microsoft.com/mem/intune/user-help/enroll-device-android-co
|
||||
**Deploy Defender for Endpoint for Android on Intune Company Portal - Device
|
||||
Administrator enrolled devices**
|
||||
|
||||
This topic describes how to deploy Defender for Endpoint for Android on Intune Company Portal - Device Administrator enrolled devices.
|
||||
Learn how to deploy Defender for Endpoint for Android on Intune Company Portal - Device Administrator enrolled devices.
|
||||
|
||||
### Add as Android store app
|
||||
|
||||
1. In [Microsoft Endpoint Manager admin
|
||||
center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
**Android Apps** \> **Add \> Android store app** and click **Select**.
|
||||
**Android Apps** \> **Add \> Android store app** and choose **Select**.
|
||||
|
||||
|
||||
|
||||
@ -60,13 +60,13 @@ center](https://go.microsoft.com/fwlink/?linkid=2109431) , go to **Apps** \>
|
||||
- **Name**
|
||||
- **Description**
|
||||
- **Publisher** as Microsoft.
|
||||
- **Appstore URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Defender for Endpoint app Google Play Store URL)
|
||||
- **App store URL** as https://play.google.com/store/apps/details?id=com.microsoft.scmx (Defender for Endpoint app Google Play Store URL)
|
||||
|
||||
Other fields are optional. Select **Next**.
|
||||
|
||||
|
||||
|
||||
3. In the *Assignments* section, go to the **Required** section and select **Add group.** You can then choose the user group(s) that you would like to target Defender for Endpoint for Android app. Click **Select** and then **Next**.
|
||||
3. In the *Assignments* section, go to the **Required** section and select **Add group.** You can then choose the user group(s) that you would like to target Defender for Endpoint for Android app. Choose **Select** and then **Next**.
|
||||
|
||||
>[!NOTE]
|
||||
>The selected user group should consist of Intune enrolled users.
|
||||
@ -111,7 +111,7 @@ Defender for Endpoint for Android supports Android Enterprise enrolled devices.
|
||||
For more information on the enrollment options supported by Intune, see
|
||||
[Enrollment Options](https://docs.microsoft.com/mem/intune/enrollment/android-enroll).
|
||||
|
||||
**Currently, Personally-owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.**
|
||||
**Currently, Personally owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.**
|
||||
|
||||
|
||||
|
||||
@ -141,7 +141,7 @@ select **Approve**.
|
||||
> 
|
||||
|
||||
|
||||
4. You should now be presented with the permissions that Defender for Endpoint
|
||||
4. You'll be presented with the permissions that Defender for Endpoint
|
||||
obtains for it to work. Review them and then select **Approve**.
|
||||
|
||||
|
||||
@ -218,7 +218,7 @@ Defender ATP should be visible in the apps list.
|
||||
|
||||
1. In the **Review + Create** page that comes up next, review all the information and then select **Create**. <br>
|
||||
|
||||
The app configuration policy for Defender for Endpoint auto-granting the storage permission is now assigned to the selected user group.
|
||||
The app configuration policy for Defender for Endpoint autogranting the storage permission is now assigned to the selected user group.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
@ -244,11 +244,11 @@ above. Then select **Review + Save** and then **Save** again to commence
|
||||
assignment.
|
||||
|
||||
### Auto Setup of Always-on VPN
|
||||
Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to setup VPN service while onboarding.
|
||||
1. On **Devices** Page go to **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise**
|
||||
Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to set up VPN service while onboarding.
|
||||
1. On **Devices**, select **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise**
|
||||
Select **Device restrictions** under one of the following, based on your device enrollment type
|
||||
- **Fully Managed, Dedicated, and Corporate-Owned Work Profile**
|
||||
- **Personally-Owned Work Profile**
|
||||
- **Personally owned Work Profile**
|
||||
|
||||
Select **Create**.
|
||||
|
||||
@ -292,7 +292,7 @@ displayed here.
|
||||
> 
|
||||
|
||||
|
||||
2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally-owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available.
|
||||
2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -37,7 +37,7 @@ Each section corresponds to a separate article in this solution.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase | Description |
|
||||
|:-------|:-----|
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 5.6 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.9 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.7 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.5 KiB |
@ -293,6 +293,7 @@ Each command is tracked with full details such as:
|
||||
|
||||
- Live response sessions are limited to 10 live response sessions at a time.
|
||||
- Large-scale command execution is not supported.
|
||||
- Live response session inactive timeout value is 5 minutes.
|
||||
- A user can only initiate one session at a time.
|
||||
- A device can only be in one session at a time.
|
||||
- The following file size limits apply:
|
||||
|
||||
@ -35,7 +35,7 @@ If you are planning to switch from McAfee Endpoint Security (McAfee) to [Microso
|
||||
|
||||
When you switch from McAfee to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|<br/>Phase 1: Prepare |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](mcafee-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](mcafee-to-microsoft-defender-setup.md) |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|[](mcafee-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](mcafee-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](mcafee-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](mcafee-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | <br>Phase 3: Onboard |
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | <br>Phase 3: Onboard |
|
||||
| ----- | ----- | ----- |
|
||||
| | |*You are here!*|
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
| <br>Phase 1: Prepare | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| <br>Phase 1: Prepare | [](production-deployment.md)<br>[Phase 2: Setup](production-deployment.md) | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| ----- | ----- | ----- |
|
||||
|*You are here!* | ||
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ ms.topic: article
|
||||
|
||||
Deploying Defender for Endpoint is a three-phase process:
|
||||
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | <br>Phase 2: Setup | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| [](prepare-deployment.md)<br>[Phase 1: Prepare](prepare-deployment.md) | <br>Phase 2: Setup | [](onboarding.md)<br>[Phase 3: Onboard](onboarding.md) |
|
||||
| ----- | ----- | ----- |
|
||||
| | *You are here!*||
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ If you are planning to switch from a non-Microsoft endpoint protection solution
|
||||
|
||||
When you switch to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|--|--|
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 3: Onboard
|
||||
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 1: Prepare
|
||||
|
||||
|<br/>Phase 1: Prepare |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](switch-to-microsoft-defender-setup.md)<br/>[Phase 2: Set up](switch-to-microsoft-defender-setup.md) |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho
|
||||
|
||||
# Switch to Microsoft Defender for Endpoint - Phase 2: Setup
|
||||
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|[](switch-to-microsoft-defender-prepare.md)<br/>[Phase 1: Prepare](switch-to-microsoft-defender-prepare.md) |<br/>Phase 2: Set up |[](switch-to-microsoft-defender-onboard.md)<br/>[Phase 3: Onboard](switch-to-microsoft-defender-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
@ -87,11 +87,11 @@ The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/d
|
||||
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender` <br/>
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
|
||||
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet: <br/>
|
||||
|
||||
@ -227,12 +227,13 @@ To use CMPivot to get your file hash, follow these steps:
|
||||
|
||||
6. In the query box, type the following query:<br/>
|
||||
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
|
||||
## Set up your device groups, device collections, and organizational units
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ If you are planning to switch from Symantec Endpoint Protection (Symantec) to [M
|
||||
|
||||
When you switch from Symantec to Microsoft Defender for Endpoint, you follow a process that can be divided into three phases, as described in the following table:
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase |Description |
|
||||
|--|--|
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |<br/>Phase 3: Onboard |
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |<br/>Phase 3: Onboard |
|
||||
|--|--|--|
|
||||
|| |*You are here!* |
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|<br/>Phase 1: Prepare |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|<br/>Phase 1: Prepare |[](symantec-to-microsoft-defender-atp-setup.md)<br/>[Phase 2: Set up](symantec-to-microsoft-defender-atp-setup.md) |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|--|--|--|
|
||||
|*You are here!*| | |
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.reviewer: depicker, yongrhee, chriggs
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |<br/>Phase 2: Set up |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|[](symantec-to-microsoft-defender-atp-prepare.md)<br/>[Phase 1: Prepare](symantec-to-microsoft-defender-atp-prepare.md) |<br/>Phase 2: Set up |[](symantec-to-microsoft-defender-atp-onboard.md)<br/>[Phase 3: Onboard](symantec-to-microsoft-defender-atp-onboard.md) |
|
||||
|--|--|--|
|
||||
||*You are here!* | |
|
||||
|
||||
@ -64,15 +64,16 @@ Now that you're moving from Symantec to Microsoft Defender for Endpoint, you'll
|
||||
|
||||
1. As a local administrator on the endpoint or device, open Windows PowerShell.
|
||||
|
||||
2. Run the following PowerShell cmdlets: <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features` <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender` <br/>
|
||||
2. Run the following PowerShell cmdlets:
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features` <br/>
|
||||
`Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`
|
||||
|
||||
> [!NOTE]
|
||||
> When using the DISM command within a task sequence running PS, the following path to cmd.exe is required.
|
||||
> Example:<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender-Features`<br/>
|
||||
> `c:\windows\sysnative\cmd.exe /c Dism /online /Get-FeatureInfo /FeatureName:Windows-Defender`<br/>
|
||||
|
||||
3. To verify Microsoft Defender Antivirus is running, use the following PowerShell cmdlet: <br/>
|
||||
`Get-Service -Name windefend`
|
||||
@ -174,10 +175,12 @@ To add exclusions to Microsoft Defender for Endpoint, you create [indicators](ht
|
||||
3. On the **File hashes** tab, choose **Add indicator**.
|
||||
|
||||
3. On the **Indicator** tab, specify the following settings:
|
||||
|
||||
- File hash (Need help? See [Find a file hash using CMPivot](#find-a-file-hash-using-cmpivot) in this article.)
|
||||
- Under **Expires on (UTC)**, choose **Never**.
|
||||
|
||||
4. On the **Action** tab, specify the following settings:
|
||||
|
||||
- **Response Action**: **Allow**
|
||||
- Title and description
|
||||
|
||||
@ -203,12 +206,14 @@ To use CMPivot to get your file hash, follow these steps:
|
||||
|
||||
6. In the query box, type the following query:<br/>
|
||||
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
```kusto
|
||||
File(c:\\windows\\notepad.exe)
|
||||
| project Hash
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> In the query above, replace *notepad.exe* with the your third-party security product process name.
|
||||
|
||||
|
||||
## Set up your device groups, device collections, and organizational units
|
||||
|
||||
|
||||
@ -165,6 +165,8 @@
|
||||
|
||||
## [Troubleshooting]()
|
||||
### [Troubleshooting UWP app connectivity issues in Windows Firewall](troubleshooting-uwp-firewall.md)
|
||||
### [Filter origin audit log improvements](filter-origin-documentation.md)
|
||||
### [Quarantine behavior](quarantine.md)
|
||||
### [Firewall settings lost on upgrade](firewall-settings-lost-on-upgrade.md)
|
||||
|
||||
|
||||
@ -179,3 +181,4 @@
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,171 @@
|
||||
---
|
||||
title: Filter origin audit log improvements
|
||||
description: Filter origin documentation audit log improvements
|
||||
ms.reviewer:
|
||||
ms.author: v-bshilpa
|
||||
ms.prod: w10
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: normal
|
||||
author: Benny-54
|
||||
manager: dansimp
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365-initiative-windows-security
|
||||
ms.topic: troubleshooting
|
||||
---
|
||||
|
||||
# Filter origin audit log improvements
|
||||
|
||||
Debugging packet drops is a continuous issue to Windows customers. In the past, customers had limited information about packet drops.
|
||||
|
||||
Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152.
|
||||
|
||||
|
||||
|
||||
The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from.
|
||||
|
||||
However, the filter ID is not a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. This makes the diagnosis process error-prone and difficult.
|
||||
|
||||
For customers to debug packet drop events correctly and efficiently, they would need more context about the blocking filter such as its origin.
|
||||
|
||||
The blocking filters can be categorized under these filter origins:
|
||||
|
||||
1. Firewall rules
|
||||
|
||||
2. Firewall default block filters
|
||||
|
||||
a. AppContainer loopback
|
||||
|
||||
b. Boottime default
|
||||
|
||||
c. Quarantine default
|
||||
|
||||
d. Query user default
|
||||
|
||||
e. Stealth
|
||||
|
||||
f. Universal Windows Platform (UWP) default
|
||||
|
||||
g. Windows Service Hardening (WSH) default
|
||||
|
||||
The next section describes the improvements made to audits 5157 and 5152, and how the above filter origins are used in these events. These improvements were added in Iron release.
|
||||
|
||||
## Improved firewall audit
|
||||
|
||||
The two new fields added to the audit 5157 and 5152 events are `Filter Origin` and `Interface Index`.
|
||||
|
||||
The `Filter Origin` field helps identify the cause of the drop. Packet drops from firewall are explicitly dropped by default block filters created by the Windows Firewall service or a firewall rule that may be created by users, policies, services, apps, etc.
|
||||
|
||||
`Filter Origin` specifies either the rule ID (a unique identifier of a Firewall rule) or the name of one of the default block filters.
|
||||
|
||||
The `Interface Index` field specifies the network interface in which the packet was dropped. This field helps to identify which interface was quarantined, if the `Filter Origin` is a `Quarantine Default`.
|
||||
|
||||
To enable a specific audit event, run the corresponding command in an administrator command prompt:
|
||||
|
||||
|**Audit #**|**Enable command**|**Link**|
|
||||
|:-----|:-----|:-----|
|
||||
|**5157**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5157(F): The Windows Filtering Platform has blocked a connection.](https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5157)|
|
||||
|**5152**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5152(F): The Windows Filtering Platform blocked a packet.](https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152)|
|
||||
|
||||
## Example flow of debugging packet drops with filter origin
|
||||
|
||||
As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on.
|
||||
|
||||
|
||||
|
||||
The next sections are divided by `Filter Origin` type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, **Firewall default block filters**. Otherwise, continue to the section **Firewall rules**.
|
||||
|
||||
## Firewall rules
|
||||
|
||||
Run the following PowerShell command to generate the rule information using `Filter Origin`.
|
||||
|
||||
```Powershell
|
||||
Get-NetFirewallRule -Name “<Filter Origin>”
|
||||
Get-NetFirewallRule -Name " {A549B7CF-0542-4B67-93F9-EEBCDD584377} "
|
||||
```
|
||||
|
||||
|
||||
|
||||
After identifying the rule that caused the drop, the network admin can now modify/disable the rule to allow the traffic they want through command prompt or using the Windows Defender UI. The network admin can find the rule in the UI with the rule’s `DisplayName`.
|
||||
|
||||
>[!NOTE]
|
||||
> Firewall rules from Mobile Device Management (MDM) store cannot be searched using the Windows Defender UI. Additionally, the above method will not work when the `Filter Origin` is one of the default block filters, as they do not correspond to any firewall rules.
|
||||
|
||||
## Firewall default block filters
|
||||
|
||||
**AppContainer loopback**
|
||||
|
||||
Network drop events from the AppContainer loopback block filter origin occur when localhost loopback is not enabled properly for the Universal Windows Platform (UWP) app.
|
||||
|
||||
To enable localhost loopback in a local debugging environment, see [Communicating with localhost](https://docs.microsoft.com/windows/iot-core/develop-your-app/loopback).
|
||||
|
||||
To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged win32 app, see [uap4:LoopbackAccessRules](https://docs.microsoft.com/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules).
|
||||
|
||||
**Boottime default**
|
||||
|
||||
Network drop events from the boottime default block filter origin occur when the computer is booting up and the firewall service is not yet running. Services will need to create a boottime allow filter to allow the traffic. It should be noted that it is not possible to add boottime filters through firewall rules.
|
||||
|
||||
**Quarantine default**
|
||||
|
||||
Network drops from the quarantine default block filter occur when the interface is temporarily quarantined by Firewall service. The firewall service quarantines an interface when it detects a change on the network, and based on several other factors, the firewall service may put the interface in quarantine as a safeguard. When an interface is in quarantine, the quarantine default block filter will block any new non-loopback inbound connections.
|
||||
|
||||
Run the following PowerShell command to generate more information about the interface:
|
||||
|
||||
```Powershell
|
||||
Get-NetIPInterface –InterfaceIndex <Interface Index>
|
||||
Get-NetIPInterface –InterfaceIndex 5
|
||||
```
|
||||
|
||||
|
||||
|
||||
To learn more about the quarantine feature, see [Quarantine behavior](quarantine.md).
|
||||
|
||||
>[!NOTE]
|
||||
> Quarantine-related packet drops are often transient and signify nothing more than a network change on the interface.
|
||||
|
||||
**Query user default**
|
||||
|
||||
Network packet drops from query user default block filters occur when there is no explicit rule created to allow an inbound connection for the packet. When an application binds to a socket but does not have a corresponding inbound rule to allow packets on that port, Windows generates a pop up for the user to allow or deny the app to receive packets on the available network categories. If the user clicks to deny the connection in this popup, subsequent inbound packets to the app will be dropped. To resolve the drops:
|
||||
|
||||
1. Create an inbound firewall rule to allow the packet for this application. This will allow the packet to bypass any query user default block filters.
|
||||
|
||||
2. Delete any block query user rules that may have been auto generated by the firewall service.
|
||||
|
||||
To generate a list of all the query user block rules, you can run the following PowerShell command:
|
||||
|
||||
```Powershell
|
||||
Get-NetFirewallRule | Where {$_.Name -like "*Query User*"}
|
||||
```
|
||||
|
||||
|
||||
|
||||
The query user pop-up feature is enabled by default.
|
||||
|
||||
To disable the query user pop-up, you can run the following in administrative command prompt:
|
||||
|
||||
```Console
|
||||
Netsh set allprofiles inboundusernotification disable
|
||||
```
|
||||
Or in PowerShell:
|
||||
|
||||
```Powershell
|
||||
Set-NetFirewallProfile -NotifyOnListen False
|
||||
```
|
||||
|
||||
**Stealth**
|
||||
|
||||
Network drops from stealth filters are typically made to prevent port scanning.
|
||||
|
||||
To disable stealth-mode, see [Disable stealth mode in Windows](https://docs.microsoft.com/troubleshoot/windows-server/networking/disable-stealth-mode).
|
||||
|
||||
**UWP default**
|
||||
|
||||
Network drops from Universal Windows Platform (UWP) default inbound/outbound block filters are often caused by the UWP app not being configured correctly (that is, the UWP app is missing the correct capability tokens or loopback is not enabled) or the private range is configured incorrectly.
|
||||
|
||||
For more information on how to debug drops caused by UWP default block filters, see [Troubleshooting UWP App Connectivity Issues](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/troubleshooting-uwp-firewall).
|
||||
|
||||
**WSH default**
|
||||
|
||||
Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn’t an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner will need to configure allow rules for the service if the block is not expected.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 147 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 130 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 124 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 182 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 182 KiB |
@ -0,0 +1,213 @@
|
||||
---
|
||||
title: Quarantine behavior
|
||||
description: Quarantine behavior is explained in detail.
|
||||
ms.author: v-bshilpa
|
||||
author: Benny-54
|
||||
manager: dansimp
|
||||
ms.assetid:
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: normal
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 11/17/2020
|
||||
---
|
||||
|
||||
# Quarantine behavior
|
||||
|
||||
One of the security challenges that network admins face is configuring a machine properly after a network change.
|
||||
|
||||
Network changes can happen frequently. Additionally, the operations required to recategorize the network after a change and apply the correct security policies on a machine are non-trivial and may require considerable CPU time. This is especially true for machines that are part of the domain. In the past, the delay in applying security policies during network recategorization has been successfully exploited for vulnerabilities.
|
||||
|
||||
To counter this potential exploitation, Windows Firewall will quarantine an interface until the system has successfully recategorized the network and Windows Filtering Platform (WFP) has the correct filters applied for the updated interface configuration. During quarantine, all new inbound connections without exceptions are blocked to the machine.
|
||||
|
||||
While the quarantine feature has long been a part of Windows Firewall, the feature behavior has often caused confusion for customers unaware of quarantine and its motivations.
|
||||
|
||||
Ultimately, the goal of this document is to describe the quarantine feature at a high level and help network admins understand why the application traffic is sometimes blocked by quarantine.
|
||||
|
||||
## Quarantine filters
|
||||
|
||||
The quarantine feature creates filters that can be split into three categories:
|
||||
|
||||
- Quarantine default inbound block filter
|
||||
- Quarantine default exception filters
|
||||
- Interface un-quarantine filters
|
||||
|
||||
These filters are added in the FWPM_SUBLAYER_MPSSVC_QUARANTINE sublayer and these layers are:
|
||||
|
||||
1. FWPM_LAYER_ALE_AUTH_CONNECT_V4
|
||||
|
||||
2. FWPM_LAYER_ALE_AUTH_CONNECT_V6
|
||||
|
||||
3. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4
|
||||
|
||||
4. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6
|
||||
|
||||
>[!NOTE]
|
||||
> Any firewall rules added by the customers will not affect the filters in the quarantine sublayer as filters from Firewall rules are added in the FWPM_SUBLAYER_MPSSVC_WF sublayer. In other words, customers cannot add their own exception filters to prevent packets from being evaluated by quarantine filters.
|
||||
|
||||
For more information about WFP layers and sublayers, see [WFP Operation](https://docs.microsoft.com/windows/win32/fwp/basic-operation).
|
||||
|
||||
### Quarantine default inbound block filter
|
||||
|
||||
The quarantine default inbound block filter effectively blocks any new non-loopback inbound connections if the packet is not explicitly permitted by another filter in the quarantine sublayer.
|
||||
|
||||
### Quarantine default exception filters
|
||||
|
||||
When the interface is in quarantine state, the quarantine default exception filters will permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the quarantine default inbound loopback exception filter. This exception filter allows all loopback packets when the interface is in quarantine state.
|
||||
|
||||
### Interface un-quarantine filter
|
||||
|
||||
The interface un-quarantine filters allow all non-loopback packets if the interface is successfully categorized.
|
||||
|
||||
## Quarantine flow
|
||||
|
||||
The following describes the general flow of quarantine:
|
||||
|
||||
1. There is some change on the current network interface.
|
||||
|
||||
2. The interface un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state.
|
||||
|
||||
3. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter.
|
||||
|
||||
4. The WFP filters applicable to the old interface state are removed.
|
||||
|
||||
5. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state.
|
||||
|
||||
6. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets.
|
||||
|
||||
## Quarantine diagnostics
|
||||
|
||||
There are two methods of identifying packet drops from the quarantine default inbound block filter.
|
||||
|
||||
Given that the network connectivity issue is reproducible, diagnostic traces can be collected by running the following in an administrative command prompt:
|
||||
|
||||
```console
|
||||
Netsh wfp cap start
|
||||
<Reproduce network connectivity issue>
|
||||
Netsh wfp cap stop
|
||||
```
|
||||
|
||||
These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains drop `netEvents` and filters that existed during that reproduction.
|
||||
|
||||
Inside the wfpdiag.xml, search for `netEvents` that have `FWPM_NET_EVENT_TYPE_CLASSIFY_DROP` as the `netEvent` type. To find the relevant drop events, search for the drop events with matching destination IP address, package SID, or application ID name.
|
||||
|
||||
The characters in the application ID name will be separated by periods:
|
||||
|
||||
```XML
|
||||
<asString> \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... </asString>
|
||||
```
|
||||
|
||||
The `netEvent` will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more.
|
||||
|
||||
If the filter that dropped that packet was by the quarantine default inbound block filter, then the drop `netEvent` will have `filterOrigin` as `Quarantine Default`.
|
||||
|
||||
The following is a sample `netEvent` with `filterOrigin` as `Quarantine Default`.
|
||||
|
||||
```XML
|
||||
<netEvent>
|
||||
<header>
|
||||
<timeStamp>2020-10-07T01:03:56.281Z</timeStamp>
|
||||
<flags numItems="9">
|
||||
<item>FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_APP_ID_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_USER_ID_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_IP_VERSION_SET</item>
|
||||
<item>FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET</item>
|
||||
</flags>
|
||||
<ipVersion>FWP_IP_VERSION_V4</ipVersion>
|
||||
<ipProtocol>17</ipProtocol>
|
||||
<localAddrV4>255.255.255.255</localAddrV4>
|
||||
<remoteAddrV4>10.195.33.252</remoteAddrV4>
|
||||
<localPort>21</localPort>
|
||||
<remotePort>61706</remotePort>
|
||||
<scopeId>0</scopeId>
|
||||
<appId>
|
||||
<data>5c00640065006d00330032005c0073007600630068006f00730074002e006500780065000000</data>
|
||||
<asString>\.d.e.v.i.c.e.\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.s.v.c.h.o.s.t...e.x.e...</asString>
|
||||
</appId>
|
||||
<userId>S-1-5-19</userId>
|
||||
<addressFamily>FWP_AF_INET</addressFamily>
|
||||
<packageSid>S-1-0-0</packageSid>
|
||||
<enterpriseId/>
|
||||
<policyFlags>0</policyFlags>
|
||||
<effectiveName/>
|
||||
</header>
|
||||
<type>FWPM_NET_EVENT_TYPE_CLASSIFY_DROP</type>
|
||||
<classifyDrop>
|
||||
<filterId>66241</filterId>
|
||||
<layerId>44</layerId>
|
||||
<reauthReason>0</reauthReason>
|
||||
<originalProfile>0</originalProfile>
|
||||
<currentProfile>0</currentProfile>
|
||||
<msFwpDirection>MS_FWP_DIRECTION_OUT</msFwpDirection>
|
||||
<isLoopback>false</isLoopback>
|
||||
<vSwitchId/>
|
||||
<vSwitchSourcePort>0</vSwitchSourcePort>
|
||||
<vSwitchDestinationPort>0</vSwitchDestinationPort>
|
||||
</classifyDrop>
|
||||
<internalFields>
|
||||
<internalFlags numItems="1">
|
||||
<item>FWPM_NET_EVENT_INTERNAL_FLAG_FILTER_ORIGIN_SET</item>
|
||||
</internalFlags>
|
||||
<capabilities/>
|
||||
<fqbnVersion>0</fqbnVersion>
|
||||
<fqbnName/>
|
||||
<terminatingFiltersInfo numItems="3">
|
||||
<item>
|
||||
<filterId>66241</filterId>
|
||||
<subLayer>FWPP_SUBLAYER_INTERNAL_FIREWALL_QUARANTINE</subLayer>
|
||||
<actionType>FWP_ACTION_BLOCK</actionType>
|
||||
</item>
|
||||
<item>
|
||||
<filterId>74045</filterId>
|
||||
<subLayer>FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH</subLayer>
|
||||
<actionType>FWP_ACTION_BLOCK</actionType>
|
||||
</item>
|
||||
<item>
|
||||
<filterId>73602</filterId>
|
||||
<subLayer>FWPP_SUBLAYER_INTERNAL_FIREWALL_WF</subLayer>
|
||||
<actionType>FWP_ACTION_BLOCK</actionType>
|
||||
</item>
|
||||
</terminatingFiltersInfo>
|
||||
<filterOrigin>Quarantine Default</filterOrigin>
|
||||
<interfaceIndex>5</interfaceIndex>
|
||||
</internalFields>
|
||||
</netEvent>
|
||||
|
||||
```
|
||||
|
||||
Alternatively, If the Filtering Platform Connection failure auditing is enabled, the drop event will be logged in Windows Event Viewer.
|
||||
|
||||
To enable Filtering Platform Connection audits, run the following command in an administrative command prompt:
|
||||
|
||||
```console
|
||||
Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable
|
||||
```
|
||||
|
||||
Sample drop audit with `filterOrigin` as `Quarantine Default`.
|
||||
|
||||
|
||||
|
||||
Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface:
|
||||
|
||||
```Powershell
|
||||
Get-NetIPInterface –InterfaceIndex <Interface Index>
|
||||
Get-NetIPInterface –InterfaceIndex 5
|
||||
```
|
||||
|
||||
|
||||
|
||||
Using the interface name, event viewer can be searched for any interface related changes.
|
||||
|
||||
To enable more networking audit events, see [Enable IPsec and Windows Firewall Audit Events](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754714(v=ws.10)?redirectedfrom=MSDN).
|
||||
|
||||
Packet drops from the quarantine default inbound block filter are often transient and do not signify anything more than a network change on the interface.
|
||||
Reference in New Issue
Block a user