From 79effbe3a7d95dd7299acb06ba258e8e4ca8a21d Mon Sep 17 00:00:00 2001 From: educabanillas <142420277+educabanillas@users.noreply.github.com> Date: Wed, 20 Sep 2023 13:03:44 +0200 Subject: [PATCH 1/4] Update dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Wrong description of procedure. All DCOM permission are retired --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 81cfb68761..449f99f377 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it to Not defined. The Blank value is set by using the ACL editor to empty the list, and then pressing OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. - *User-defined input* of the SDDL representation of the groups and privileges From da7de5b5aeac0397eccdd5f5e37c2bdf9dcde53e Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 16 Oct 2023 12:47:35 -0400 Subject: [PATCH 2/4] Added new rules and updates since 2309 --- ...icrosoft-recommended-driver-block-rules.md | 367 +++++++++++++++++- 1 file changed, 362 insertions(+), 5 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 398a529b8e..3eac346b20 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -81,7 +81,7 @@ To check that the policy was successfully applied on your computer: ```xml - 10.0.25930.0 + 10.0.25965.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -662,6 +662,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -691,6 +695,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -889,6 +977,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -915,6 +1023,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -1171,6 +1295,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1213,10 +1387,10 @@ To check that the policy was successfully applied on your computer: - + - + @@ -1225,7 +1399,7 @@ To check that the policy was successfully applied on your computer: - + @@ -1241,6 +1415,7 @@ To check that the policy was successfully applied on your computer: + @@ -1353,6 +1528,7 @@ To check that the policy was successfully applied on your computer: + @@ -1476,6 +1652,7 @@ To check that the policy was successfully applied on your computer: + @@ -1994,6 +2171,11 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -2195,6 +2377,7 @@ To check that the policy was successfully applied on your computer: + @@ -2811,6 +2994,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -2840,6 +3027,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3039,6 +3310,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -3065,6 +3356,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -3325,6 +3632,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3357,7 +3714,7 @@ To check that the policy was successfully applied on your computer: - 10.0.25930.0 + 10.0.25965.0 From c0d04ac4c410b9d1ed38fb295233fde8cb13cf11 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 17 Oct 2023 06:22:27 -0400 Subject: [PATCH 3/4] removed retired content links --- .../credential-guard/considerations-known-issues.md | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/considerations-known-issues.md b/windows/security/identity-protection/credential-guard/considerations-known-issues.md index 26ee36124b..dbf52336f8 100644 --- a/windows/security/identity-protection/credential-guard/considerations-known-issues.md +++ b/windows/security/identity-protection/credential-guard/considerations-known-issues.md @@ -209,19 +209,6 @@ The following issue affects the Java GSS API. See the following Oracle bug datab When Credential Guard is enabled on Windows, the Java GSS API doesn't authenticate. Credential Guard blocks specific application authentication capabilities and doesn't provide the TGT session key to applications, regardless of registry key settings. For more information, see [Application requirements](index.md#application-requirements). -The following issue affects McAfee Application and Change Control (MACC): - -- [KB88869 Windows machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Credential Guard is enabled](https://kcm.trellix.com/corporate/index?page=content&id=KB88869) - -The following issue affects Citrix applications: - -- Windows machines exhibit high CPU usage with Citrix applications installed when Credential Guard is enabled. - -> [!NOTE] -> Products that connect to Virtualization Based Security (VBS) protected processes can cause Credential Guard-enabled devices to exhibit high CPU usage. For technical and troubleshooting information, see [KB4032786 High CPU usage in the LSAISO process on Windows](/troubleshoot/windows-client/performance/lsaiso-process-high-cpu-usage). -> -> For more technical information on LSAISO.exe, see [Isolated User Mode (IUM) Processes](/windows/win32/procthread/isolated-user-mode--ium--processes). - #### Vendor support The following products and services don't support Credential Guard: From 710cfe8cca823f8ace97c489c9249b3a89551eee Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 17 Oct 2023 10:39:00 -0400 Subject: [PATCH 4/4] Update windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...ns-in-security-descriptor-definition-language-sddl-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 449f99f377..d4c07f3415 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -37,7 +37,7 @@ Access and Remote Access permissions to users and groups. We recommend that you - Blank - This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, and then select OK. + This value represents how the local security policy deletes the policy enforcement key. This value deletes the policy and then sets it as Not defined. To set a blank value, select "Define this policy setting" and leave the Security descriptor empty, then select OK. - *User-defined input* of the SDDL representation of the groups and privileges