mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
Merging changes synced from https://github.com/MicrosoftDocs/windows-docs-pr (branch live)
This commit is contained in:
dstrome
commit
cb45703fff
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BCD settings and BitLocker
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker and Active Directory Domain Services (AD DS) FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker basic deployment
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Countermeasures
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker frequently asked questions (FAQ)
|
||||
|
||||
@ -14,6 +14,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.reviewer:
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Overview of BitLocker Device Encryption in Windows 10
|
||||
|
||||
@ -15,9 +15,10 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker frequently asked questions (FAQ)
|
||||
# BitLocker frequently asked questions (FAQ) resources
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/17/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Group Policy settings
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker: How to deploy on Windows Server 2012 and later
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker: How to enable Network Unlock
|
||||
@ -367,7 +368,7 @@ The following steps can be used to configure Network Unlock on these older syste
|
||||
6. Configure registry settings for Network Unlock:
|
||||
|
||||
Apply the registry settings by running the following certutil script (assuming your network unlock certificate file is called **BitLocker-NetworkUnlock.cer**) on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic.
|
||||
|
||||
```console
|
||||
certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f
|
||||
@ -376,6 +377,7 @@ The following steps can be used to configure Network Unlock on these older syste
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f
|
||||
```
|
||||
|
||||
7. Set up a TPM protector on the clients
|
||||
8. Reboot the clients to add the Network (Certificate Based) protector
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Key Management FAQ
|
||||
|
||||
@ -14,6 +14,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.reviewer:
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Management for Enterprises
|
||||
|
||||
@ -14,6 +14,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.reviewer:
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Network Unlock FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Overview and Requirements FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 01/26/2018
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker recovery guide
|
||||
|
||||
@ -14,6 +14,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 10/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Breaking out of a Bitlocker recovery loop
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Security FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 07/10/2018
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker To Go FAQ
|
||||
|
||||
@ -14,6 +14,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.reviewer:
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Upgrading FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker: Use BitLocker Recovery Password Viewer
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Using BitLocker with other programs FAQ
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/24/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Prepare your organization for BitLocker: Planning and policies
|
||||
|
||||
@ -15,6 +15,7 @@ audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/28/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Protecting cluster shared volumes and storage area networks with BitLocker
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/17/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Guidelines for troubleshooting BitLocker
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/17/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker cannot encrypt a drive: known issues
|
||||
|
||||
@ -13,8 +13,10 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/18/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
|
||||
# BitLocker cannot encrypt a drive: known TPM issues
|
||||
|
||||
This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues.
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/17/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker configuration: known issues
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/17/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Decode Measured Boot logs to track PCR changes
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/18/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# Enforcing BitLocker policies by using Intune: known issues
|
||||
@ -205,7 +206,7 @@ To verify the Secure Boot state, use the System Information app. To do this, fol
|
||||
1. Verify that the **Secure Boot State** setting is **On**, as follows:
|
||||
|
||||
1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device.
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> You can also use the [Confirm-SecureBootUEFI](https://docs.microsoft.com/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command:
|
||||
|
||||
@ -13,7 +13,9 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/7/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker Network Unlock: known issues
|
||||
|
||||
By using the BitLocker Network Unlock feature, you can manage computers remotely without having to enter a BitLocker PIN when each computer starts up. To do this, You have to configure your environment to meet the following requirements:
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/18/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker recovery: known issues
|
||||
|
||||
@ -13,6 +13,7 @@ audience: ITPro
|
||||
ms.collection: Windows Security Technologies\BitLocker
|
||||
ms.topic: troubleshooting
|
||||
ms.date: 10/18/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
# BitLocker and TPM: other known issues
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Overview of advanced hunting in Microsoft Defender ATP
|
||||
description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, custom detections, schema, kusto
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp, search, query, telemetry, custom detections, schema, kusto, time zone, UTC
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -43,10 +43,14 @@ You can also go through each of the following steps to ramp up your advanced hun
|
||||
| **Use predefined queries** | Explore collections of predefined queries covering different threat hunting scenarios. | [Shared queries](advanced-hunting-shared-queries.md) |
|
||||
| **Learn about custom detections** | Understand how you can use advanced hunting queries to trigger alerts and apply response actions automatically. | - [Custom detections overview](overview-custom-detections.md)<br>- [Custom detection rules](custom-detection-rules.md) |
|
||||
|
||||
## Get help as you write queries
|
||||
Take advantage of the following functionality to write queries faster:
|
||||
- **Autosuggest** — as you write queries, advanced hunting provides suggestions from IntelliSense.
|
||||
- **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor.
|
||||
## Data freshness and update frequency
|
||||
Advanced hunting data can be categorized into two distinct types, each consolidated differently:
|
||||
|
||||
- **Event or activity data**—populates tables about alerts, security events, system events, and routine assessments. Advanced hunting receives this data almost immediately after the sensors that collect them successfully transmit them to Microsoft Defender ATP.
|
||||
- **Entity data**—populates tables with consolidated information about users and devices. To provide fresh data, tables are updated every 15 minutes with any new information, adding rows that might not be fully populated. Every 24 hours, data is consolidated to insert a record that contains the latest, most comprehensive data set about each entity.
|
||||
|
||||
## Time zone
|
||||
All time information in advanced hunting is currently in the UTC time zone.
|
||||
|
||||
## Related topics
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
|
||||
@ -144,11 +144,28 @@ Data in advanced hunting tables are generally classified into the following data
|
||||
| `int` | 32-bit numeric value |
|
||||
| `long` | 64-bit numeric value |
|
||||
|
||||
## Get help as you write queries
|
||||
Take advantage of the following functionality to write queries faster:
|
||||
|
||||
- **Autosuggest**—as you write queries, advanced hunting provides suggestions from IntelliSense.
|
||||
- **Schema tree**—a schema representation that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor.
|
||||
- **[Schema reference](advanced-hunting-schema-reference.md#get-schema-information-in-the-security-center)**—in-portal reference with table and column descriptions as well as supported event types (`ActionType` values) and sample queries
|
||||
|
||||
## Work with multiple queries in the editor
|
||||
The query editor can serve as your scratch pad for experimenting with multiple queries. To use multiple queries:
|
||||
|
||||
- Separate each query with an empty line.
|
||||
- Place the cursor on any part of a query to select that query before running it. This will run only the selected query. To run another query, move the cursor accordingly and select **Run query**.
|
||||
|
||||
|
||||
_Query editor with multiple queries_
|
||||
|
||||
|
||||
## Use sample queries
|
||||
|
||||
The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository.
|
||||
|
||||
@ -24,8 +24,6 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
[!INCLUDE [Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
While you can construct your [advanced hunting](advanced-hunting-overview.md) queries to return very precise information, you can also work with the query results to gain further insight and investigate specific activities and indicators. You can take the following actions on your query results:
|
||||
|
||||
- View results as a table or chart
|
||||
|
||||
@ -29,7 +29,20 @@ ms.date: 01/14/2020
|
||||
|
||||
The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about devices and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema.
|
||||
|
||||
## Schema tables
|
||||
## Get schema information in the security center
|
||||
While constructing queries, use the built-in schema reference to quickly get the following information about each table in the schema:
|
||||
|
||||
- **Tables description**—type of data contained in the table and the source of that data.
|
||||
- **Columns**—all the columns in the table.
|
||||
- **Action types**—possible values in the `ActionType` column representing the event types supported by the table. This is provided only for tables that contain event information.
|
||||
- **Sample query**—example queries that feature how the table can be utilized.
|
||||
|
||||
### Access the schema reference
|
||||
To quickly access the schema reference, select the **View reference** action next to the table name in the schema representation. You can also select **Schema reference** to search for a table.
|
||||
|
||||
|
||||
|
||||
## Learn the schema tables
|
||||
|
||||
The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prevent ransomware and threats from encrypting and changing files
|
||||
description: Files in default folders can be protected from being changed by malicious apps. This can help prevent ransomware from encrypting your files.
|
||||
description: Files in default folders can be protected from being changed by malicious apps. Prevent ransomware from encrypting your files.
|
||||
keywords: controlled folder access, windows 10, windows defender, ransomware, protect, files, folders
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
audience: ITPro
|
||||
ms.date: 08/05/2019
|
||||
ms.date: 08/25/2020
|
||||
ms.reviewer: v-maave
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -23,17 +23,21 @@ ms.custom: asr
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It protects your data by checking against a list of known, trusted apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. It can be turned on via the Windows Security App, or from the Microsoft Endpoint Configuration Manager and Intune, for managed devices. Controlled folder access works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
## What is controlled folder access?
|
||||
|
||||
Controlled folder access works by only allowing apps to access protected folders if the app is included on a list of trusted software. If an app isn't on the list, Controlled folder access will block it from making changes to files inside protected folders.
|
||||
Controlled folder access helps you protect your valuable data from malicious apps and threats, like ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App or in Microsoft Endpoint Configuration Manager and Intune (for managed devices).
|
||||
|
||||
Apps are added to the trusted list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization, and that have never displayed any malicious behavior, are deemed trustworthy and automatically added to the list.
|
||||
Controlled folder access works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
## How does controlled folder access work?
|
||||
|
||||
Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.
|
||||
|
||||
Controlled folder access works with a list of trusted software. If an app is included in the list of trusted software, the app works as expected. If not, the app is blocked from making any changes to files that are inside protected folders. Apps are added to the trusted list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization, and that have never displayed any malicious behavior, are deemed trustworthy and automatically added to the list.
|
||||
|
||||
Apps can also be manually added to the trusted list via Configuration Manager and Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for the app, can be performed from the Security Center Console.
|
||||
|
||||
Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage.
|
||||
|
||||
With Controlled folder access in place, a notification will appear on the computer where the app attempted to make changes to a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware). In a ransomware attack, your files can get encrypted and held hostage. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
|
||||
The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
|
||||
|
||||
@ -45,13 +49,13 @@ Controlled folder access is supported on Windows 10, version 1709 and later and
|
||||
|
||||
Controlled folder access requires enabling [Microsoft Defender Antivirus real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
## Review controlled folder access events in the Microsoft Defender ATP Security Center
|
||||
## Review controlled folder access events in the Microsoft Defender Security Center
|
||||
|
||||
Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled.
|
||||
|
||||
Here is an example query
|
||||
Example query:
|
||||
|
||||
```PowerShell
|
||||
DeviceEvents
|
||||
@ -66,24 +70,42 @@ You can review the Windows event log to see events that are created when control
|
||||
|
||||
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
|
||||
|
||||
3. On the left panel, under **Actions**, click **Import custom view...**.
|
||||
3. On the left panel, under **Actions**, select **Import custom view...**.
|
||||
|
||||
4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views.md).
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
This will create a custom view that filters to only show the following events related to controlled folder access:
|
||||
After following the procedure, you have created a custom view that shows events related to controlled folder access, as listed in the following table:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1124 | Audited controlled folder access event
|
||||
1123 | Blocked controlled folder access event
|
||||
|Event ID | Description |
|
||||
|---|---|
|
||||
|5007 | Event when settings are changed |
|
||||
|1124 | Audited controlled folder access event |
|
||||
|1123 | Blocked controlled folder access event |
|
||||
|
||||
## In this section
|
||||
## View or change the list of protected folders
|
||||
|
||||
Topic | Description
|
||||
-|-
|
||||
[Evaluate controlled folder access](evaluate-controlled-folder-access.md) | Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created.
|
||||
[Enable controlled folder access](enable-controlled-folders.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage controlled folder access in your network
|
||||
[Customize controlled folder access](customize-controlled-folders.md) | Add additional protected folders, and allow specified apps to access protected folders.
|
||||
### Windows 10 security app
|
||||
|
||||
1. On your Windows 10 device, open the Windows Security app.
|
||||
|
||||
2. Select **Virus & threat protection**.
|
||||
|
||||
3. Under **Ransomware protection**, select **Manage ransomware protection**.
|
||||
|
||||
4. If controlled folder access is turned off, you'll need to turn it on. Select **protected folders**.
|
||||
|
||||
5. Do one of the following steps:
|
||||
|
||||
- To add a folder, select **+ Add a protected folder**.
|
||||
|
||||
- To remove a folder, select it, and then select **Remove**.
|
||||
|
||||
## See also
|
||||
|
||||
- [Evaluate controlled folder access](evaluate-controlled-folder-access.md). Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created.
|
||||
|
||||
- [Enable controlled folder access](enable-controlled-folders.md). Use Group Policy, PowerShell, or mobile device management CSPs to enable and manage controlled folder access in your network
|
||||
|
||||
- [Customize controlled folder access](customize-controlled-folders.md). Add additional protected folders, and allow specified apps to access protected folders.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 67 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 78 KiB |
@ -139,7 +139,7 @@ Threat Analytics is a set of interactive reports published by the Microsoft Defe
|
||||
|
||||
- [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)
|
||||
- Antimalware Scan Interface (AMSI) was extended to cover Office VBA macros as well. [Office VBA + AMSI: Parting the veil on malicious macros](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/).
|
||||
- Microsoft Defender Antivirus, new in Windows 10 version 1809, can now [run within a sandbox](https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/microsoft-defender-antivirus-can-now-run-in-a-sandbox/) (preview), increasing its security.
|
||||
- Microsoft Defender Antivirus, new in Windows 10 version 1809, can now [run within a sandbox](https://www.microsoft.com/security/blog/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox) (preview), increasing its security.
|
||||
- [Configure CPU priority settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus) for Microsoft Defender Antivirus scans.
|
||||
|
||||
|
||||
|
||||
@ -9,6 +9,7 @@
|
||||
#### [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md)
|
||||
#### [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md)
|
||||
#### [Authorize apps deployed with a WDAC managed installer](use-windows-defender-application-control-with-managed-installer.md)
|
||||
##### [Configure a WDAC managed installer](configure-wdac-managed-installer.md)
|
||||
#### [Authorize reputable apps with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md)
|
||||
#### [Use multiple WDAC policies](deploy-multiple-windows-defender-application-control-policies.md)
|
||||
#### [Microsoft recommended block rules](microsoft-recommended-block-rules.md)
|
||||
|
||||
@ -0,0 +1,160 @@
|
||||
---
|
||||
title: Configure a WDAC managed installer (Windows 10)
|
||||
description: Explains how to configure a custom Manged Installer.
|
||||
keywords: security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 08/14/2020
|
||||
---
|
||||
|
||||
# Configuring a managed installer with AppLocker and Windows Defender Application Control
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2019
|
||||
|
||||
Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled.
|
||||
There are three primary steps to keep in mind:
|
||||
|
||||
- Specify managed installers by using the Managed Installer rule collection in AppLocker policy.
|
||||
- Enable service enforcement in AppLocker policy.
|
||||
- Enable the managed installer option in a WDAC policy.
|
||||
|
||||
## Specify managed installers using the Managed Installer rule collection in AppLocker policy
|
||||
|
||||
The identity of the managed installer executable(s) is specified in an AppLocker policy in a Managed Installer rule collection.
|
||||
|
||||
### Create Managed Installer rule collection
|
||||
|
||||
Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO.
|
||||
|
||||
1. Use [New-AppLockerPolicy](https://docs.microsoft.com/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability.
|
||||
|
||||
```powershell
|
||||
Get-ChildItem <exe filepath> | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml
|
||||
```
|
||||
|
||||
2. Manually rename the rule collection to ManagedInstaller
|
||||
|
||||
Change
|
||||
|
||||
```powershell
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured">
|
||||
```
|
||||
|
||||
to
|
||||
|
||||
```powershell
|
||||
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
|
||||
```
|
||||
|
||||
An example of a valid Managed Installer rule collection using Microsoft Endpoint Config Manager (MEMCM) is shown below.
|
||||
|
||||
```xml
|
||||
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
|
||||
<FilePublisherRule Id="6cc9a840-b0fd-4f86-aca7-8424a22b4b93" Name="MEMCM - CCMEXEC.EXE, 5.0.0.0+, Microsoft signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="CCMEXEC.EXE">
|
||||
<BinaryVersionRange LowSection="5.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
<FilePublisherRule Id="780ae2d3-5047-4240-8a57-767c251cbb12" Name="MEMCM - CCMSETUP.EXE, 5.0.0.0+, Microsoft signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="CCMSETUP.EXE">
|
||||
<BinaryVersionRange LowSection="5.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
```
|
||||
|
||||
### Enable service enforcement in AppLocker policy
|
||||
|
||||
Since many installation processes rely on services, it is typically necessary to enable tracking of services.
|
||||
Correct tracking of services requires the presence of at least one rule in the rule collection, so a simple audit only rule will suffice. This can be added to the policy created above which specifies your managed installer rule collection.
|
||||
|
||||
For example:
|
||||
|
||||
```xml
|
||||
<RuleCollection Type="Dll" EnforcementMode="AuditOnly" >
|
||||
<FilePathRule Id="86f235ad-3f7b-4121-bc95-ea8bde3a5db5" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
||||
<Conditions>
|
||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.dll" />
|
||||
</Conditions>
|
||||
</FilePathRule>
|
||||
<RuleCollectionExtensions>
|
||||
<ThresholdExtensions>
|
||||
<Services EnforcementMode="Enabled" />
|
||||
</ThresholdExtensions>
|
||||
<RedstoneExtensions>
|
||||
<SystemApps Allow="Enabled"/>
|
||||
</RedstoneExtensions>
|
||||
</RuleCollectionExtensions>
|
||||
</RuleCollection>
|
||||
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
|
||||
<FilePathRule Id="9420c496-046d-45ab-bd0e-455b2649e41e" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
||||
<Conditions>
|
||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.exe" />
|
||||
</Conditions>
|
||||
</FilePathRule>
|
||||
<RuleCollectionExtensions>
|
||||
<ThresholdExtensions>
|
||||
<Services EnforcementMode="Enabled" />
|
||||
</ThresholdExtensions>
|
||||
<RedstoneExtensions>
|
||||
<SystemApps Allow="Enabled"/>
|
||||
</RedstoneExtensions>
|
||||
</RuleCollectionExtensions>
|
||||
</RuleCollection>
|
||||
```
|
||||
|
||||
## Enable the managed installer option in WDAC policy
|
||||
|
||||
In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy.
|
||||
This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) with Option 13.
|
||||
|
||||
Below are steps to create a WDAC policy which allows Windows to boot and enables the managed installer option.
|
||||
|
||||
1. Copy the DefaultWindows_Audit policy into your working folder from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml
|
||||
|
||||
2. Reset the policy ID to ensure it is in multiple policy format and give it a different GUID from the example policies. Also give it a friendly name to help with identification.
|
||||
|
||||
Ex.
|
||||
|
||||
```powershell
|
||||
Set-CIPolicyIdInfo -FilePath <XML filepath> -PolicyName "<friendly name>" -ResetPolicyID
|
||||
```
|
||||
|
||||
3. Set Option 13 (Enabled:Managed Installer)
|
||||
|
||||
```powershell
|
||||
Set-RuleOption -FilePath <XML filepath> -Option 13
|
||||
```
|
||||
|
||||
## Set the AppLocker filter driver to autostart
|
||||
|
||||
To enable the managed installer, you need to set the AppLocker filter driver to autostart and start it.
|
||||
|
||||
To do so, run the following command as an Administrator:
|
||||
|
||||
```console
|
||||
appidtel.exe start [-mionly]
|
||||
```
|
||||
|
||||
Specify `-mionly` if you will not use the Intelligent Security Graph (ISG).
|
||||
|
||||
## Enabling managed installer logging events
|
||||
|
||||
Refer to [Understanding Application Control Events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) for information on enabling optional managed installer diagnostic events.
|
||||
@ -30,7 +30,7 @@ A Windows Defender Application Control (WDAC) policy logs events locally in Wind
|
||||
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 3076 | Audit executable/dll file |
|
||||
| 3077 | Block executable/dll file |
|
||||
| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is.<br>Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. |
|
||||
| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is.<br>Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". |
|
||||
| 3099 | Indicates that a policy has been loaded |
|
||||
|
||||
## Microsoft Windows Applocker MSI and Script log event IDs
|
||||
@ -39,7 +39,7 @@ A Windows Defender Application Control (WDAC) policy logs events locally in Wind
|
||||
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the scripthosts themselves. Note: there is no WDAC enforcement on 3rd party scripthosts. |
|
||||
| 8029 | Block script/MSI file |
|
||||
| 8038 | Signing information event correlated with either a 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. | |
|
||||
| 8038 | Signing information event correlated with either a 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | |
|
||||
|
||||
## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events
|
||||
|
||||
@ -73,7 +73,8 @@ In order to enable 3091 audit events and 3092 block events, you must create a Te
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x100
|
||||
```
|
||||
In order to enable 3090 allow events, you must create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command:
|
||||
|
||||
In order to enable 3090 allow events as well as 3091 and 3092 events, you must instead create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command:
|
||||
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 06/13/2018
|
||||
ms.date: 08/14/2020
|
||||
---
|
||||
|
||||
# Authorize apps deployed with a WDAC managed installer
|
||||
@ -24,136 +24,21 @@ ms.date: 06/13/2018
|
||||
- Windows 10
|
||||
- Windows Server 2019
|
||||
|
||||
Creating and maintaining application execution control policies has always been challenging, and finding ways to address this issue has been a frequently-cited request for customers of AppLocker and Windows Defender Application Control (WDAC).
|
||||
This is especially true for enterprises with large, ever changing software catalogs.
|
||||
|
||||
Windows 10, version 1703 (also known as the Windows 10 Creators Update) provides a new option, known as a managed installer, that allows IT administrators to automatically authorize applications deployed and installed by a designated software distribution solution, such as Microsoft Endpoint Configuration Manager.
|
||||
Windows 10, version 1703 (also known as the Windows 10 Creators Update) provides a new option, known as a managed installer, that allows IT administrators to automatically authorize applications deployed and installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager.
|
||||
A managed installer helps an IT admin balance security and manageability requirements when employing application execution control policies by providing an option that does not require specifying explicit rules for software that is being managed through a software distribution solution.
|
||||
|
||||
## How does a managed installer work?
|
||||
|
||||
A managed installer uses a new rule collection in AppLocker to specify one or more executables that are trusted by the organization as an authorized source for application deployment.
|
||||
Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable’s process (or processes it launches) as having originated from a trusted installation authority. The Managed Installer rule collection is currently supported for AppLocker rules in Group Policy and in Configuration Manager, but not in the AppLocker CSP for OMA-URI policies.
|
||||
|
||||
Once the IT administrator adds the Allow: Managed Installer option to a WDAC policy, the WDAC component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy.
|
||||
If there are no deny rules present for the file, it will be authorized based on the managed installer origin information.
|
||||
Specifying an executable as a managed installer will cause Windows to tag files that are written from the executable's process (or processes it launches) as having originated from a trusted installation authority. The Managed Installer rule collection is currently supported for AppLocker rules in Group Policy and in Configuration Manager, but not in the AppLocker CSP for OMA-URI policies.
|
||||
|
||||
Once the IT administrator adds the Allow: Managed Installer option to a WDAC policy, the WDAC component will subsequently check for the presence of the origin information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the managed installer origin information.
|
||||
|
||||
Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be deployed through a managed installer.
|
||||
Examples of WDAC policies available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies help authorize Windows OS components, WHQL signed drivers and all Store apps.
|
||||
An example managed installer use-case can be seen in the guidance for [creating a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md).
|
||||
|
||||
## Configuring a managed installer with AppLocker and Windows Defender Application Control
|
||||
|
||||
Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled.
|
||||
There are three primary steps to keep in mind:
|
||||
|
||||
- Specify managed installers by using the Managed Installer rule collection in AppLocker policy.
|
||||
- Enable service enforcement in AppLocker policy.
|
||||
- Enable the managed installer option in a WDAC policy.
|
||||
|
||||
### Specify managed installers using the Managed Installer rule collection in AppLocker policy
|
||||
|
||||
The identity of the managed installer executable(s) is specified in an AppLocker policy in a Managed Installer rule collection.
|
||||
Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO.
|
||||
|
||||
An example of a valid Managed Installer rule collection is shown below.
|
||||
For more information about creating an AppLocker policy that includes a managed installer and configuring client devices, see [Simplify application listing with Configuration Manager and Windows 10](https://cloudblogs.microsoft.com/enterprisemobility/2016/06/20/configmgr-as-a-managed-installer-with-win10/).
|
||||
As mentioned above, the AppLocker CSP for OMA-URI policies does not currently support the Managed Installer rule collection or the Service Enforcement rule extensions mentioned below.
|
||||
|
||||
|
||||
```xml
|
||||
<RuleCollection Type="ManagedInstaller" EnforcementMode="AuditOnly">
|
||||
<FilePublisherRule Id="6cc9a840-b0fd-4f86-aca7-8424a22b4b93" Name="CMM - CCMEXEC.EXE, 5.0.0.0+, Microsoft signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="SYSTEM CENTER CONFIGURATION MANAGER" BinaryName="CCMEXEC.EXE">
|
||||
<BinaryVersionRange LowSection="5.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
<FilePublisherRule Id="780ae2d3-5047-4240-8a57-767c251cbb12" Name="CCM - CCMSETUP.EXE, 5.0.0.0+, Microsoft signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="SYSTEM CENTER CONFIGURATION MANAGER" BinaryName="CCMSETUP.EXE">
|
||||
<BinaryVersionRange LowSection="5.0.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
```
|
||||
|
||||
## Enable service enforcement in AppLocker policy
|
||||
|
||||
Since many installation processes rely on services, it is typically necessary to enable tracking of services.
|
||||
Correct tracking of services requires the presence of at least one rule in the rule collection — a simple audit only rule will suffice.
|
||||
For example:
|
||||
|
||||
```xml
|
||||
<RuleCollection Type="Dll" EnforcementMode="AuditOnly" >
|
||||
<FilePathRule Id="86f235ad-3f7b-4121-bc95-ea8bde3a5db5" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
||||
<Conditions>
|
||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.dll" />
|
||||
</Conditions>
|
||||
</FilePathRule>
|
||||
<RuleCollectionExtensions>
|
||||
<ThresholdExtensions>
|
||||
<Services EnforcementMode="Enabled" />
|
||||
</ThresholdExtensions>
|
||||
<RedstoneExtensions>
|
||||
<SystemApps Allow="Enabled"/>
|
||||
</RedstoneExtensions>
|
||||
</RuleCollectionExtensions>
|
||||
</RuleCollection>
|
||||
<RuleCollection Type="Exe" EnforcementMode="AuditOnly">
|
||||
<FilePathRule Id="9420c496-046d-45ab-bd0e-455b2649e41e" Name="Dummy Rule" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
|
||||
<Conditions>
|
||||
<FilePathCondition Path="%OSDRIVE%\ThisWillBeBlocked.exe" />
|
||||
</Conditions>
|
||||
</FilePathRule>
|
||||
<RuleCollectionExtensions>
|
||||
<ThresholdExtensions>
|
||||
<Services EnforcementMode="Enabled" />
|
||||
</ThresholdExtensions>
|
||||
<RedstoneExtensions>
|
||||
<SystemApps Allow="Enabled"/>
|
||||
</RedstoneExtensions>
|
||||
</RuleCollectionExtensions>
|
||||
</RuleCollection>
|
||||
```
|
||||
|
||||
### Enable the managed installer option in WDAC policy
|
||||
|
||||
In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy.
|
||||
This can be done by using the [Set-RuleOption cmdlet](https://docs.microsoft.com/powershell/module/configci/set-ruleoption).
|
||||
An example of the managed installer option being set in policy is shown below.
|
||||
|
||||
```xml
|
||||
<Rules>
|
||||
<Rule>
|
||||
<Option>Enabled:Unsigned System Integrity Policy</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Advanced Boot Options Menu</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:UMCI</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Inherit Default Policy</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Managed Installer </Option>
|
||||
</Rule>
|
||||
</Rules>
|
||||
```
|
||||
|
||||
## Set the AppLocker filter driver to autostart
|
||||
|
||||
To enable the managed installer, you need to set the AppLocker filter driver to autostart and start it.
|
||||
Run the following command as an Administrator:
|
||||
|
||||
```console
|
||||
appidtel.exe start [-mionly]
|
||||
```
|
||||
|
||||
Specify `-mionly` if you will not use the Intelligent Security Graph (ISG).
|
||||
Note that a WDAC policy with managed installer configured will begin to tag files which originated from that managed installer, regardless of whether the policy is in audit or enforced mode.
|
||||
|
||||
## Security considerations with managed installer
|
||||
|
||||
@ -167,15 +52,12 @@ To avoid this, ensure that the application deployment solution being used as a m
|
||||
|
||||
## Known limitations with managed installer
|
||||
|
||||
- Application execution control based on managed installer does not support applications that self-update.
|
||||
- Application execution control based on managed installer does not support applications that self-update/auto-update.
|
||||
If an application deployed by a managed installer subsequently updates itself, the updated application files will no longer include the managed installer origin information and will not be authorized to run.
|
||||
Enterprises should deploy and install all application updates using the managed installer.
|
||||
In some cases, it may be possible to also designate an application binary that performs the self-updates as a managed installer.
|
||||
Proper review for functionality and security should be performed for the application before using this method.
|
||||
|
||||
- Although WDAC policies can be deployed in both audit and enforced mode, the managed installer option is currently only recommended for use with policies set to enforced except in lab environments.
|
||||
Using the managed installer option with WDAC policies set to audit only may result in unexpected behavior if the policy is subsequently changed to enforced mode.
|
||||
|
||||
- Modern apps deployed through a managed installer will not be tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy.
|
||||
|
||||
- Executables that extract files and then attempt to execute may not be allowed by the managed installer heuristic.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user