mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-17 15:57:23 +00:00
Merge branch 'master' into lsaldanha-4850091
This commit is contained in:
Lovina Saldanha
GitHub
commit
cf50bb9558
@ -35,7 +35,7 @@
|
||||
"
|
||||
## Acrolinx Scorecards
|
||||
|
||||
**The minimum Acrolinx topic score of 65 is required for all MARVEL content merged to the default branch.**
|
||||
**The minimum Acrolinx topic score of 80 is required for all MARVEL content merged to the default branch.**
|
||||
|
||||
If you need a scoring exception for content in this PR, add the *Sign off* and the *Acrolinx exception* labels to the PR. The PubOps Team will review the exception request and may take one or more of the following actions:
|
||||
|
||||
|
||||
@ -16535,6 +16535,11 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventory-table",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr",
|
||||
|
||||
@ -82,22 +82,30 @@ First, you create a default user profile with the customizations that you want,
|
||||
|
||||
1. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges.
|
||||
|
||||
1. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section.
|
||||
1. Right-click **Start**, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. Alternatively, starting in Windows 10, version 2004, open the **Settings** app and select **Advanced system settings**.
|
||||
|
||||
Starting in Windows 10 version (2004) Open the Settings app and click on Advanced system settings
|
||||
|
||||
1. In **User Profiles**, click **Default Profile**, and then click **Copy To**.
|
||||
|
||||
|
||||
|
||||
|
||||
1. In **Copy To**, under **Permitted to use**, click **Change**.
|
||||
|
||||
|
||||
|
||||
1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**.
|
||||
1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone` or the group of users that the profile will be assigned to, click **Check Names**, and then click **OK**.
|
||||
|
||||
1. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#profile-extension-for-each-windows-version) for the operating system version. For example, the folder name must end with ".v6" to identify it as a user profile folder for Windows 10, version 1607.
|
||||
|
||||
- If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path.
|
||||
|
||||
|
||||
|
||||
- If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location.
|
||||
- Optionally, you can check the **Mandatory profile** checkbox. This step is not required but will set permissions that are more restrictive and we recommend doing so.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -159,16 +159,16 @@
|
||||
### [Personalization CSP](personalization-csp.md)
|
||||
#### [Personalization DDF file](personalization-ddf.md)
|
||||
### [Policy CSP](policy-configuration-service-provider.md)
|
||||
#### [Policy DDF file](policy-ddf-file.md)
|
||||
#### [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md)
|
||||
#### [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md)
|
||||
#### [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md)
|
||||
#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policy-csps-that-can-be-set-using-eas.md)
|
||||
#### [Policy CSP DDF file](policy-ddf-file.md)
|
||||
#### [Policies in Policy CSP supported by Group Policy](policies-in-policy-csp-supported-by-group-policy.md)
|
||||
#### [ADMX-backed policies in Policy CSP](policies-in-policy-csp-admx-backed.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens 2](policies-in-policy-csp-supported-by-hololens2.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policies-in-policy-csp-supported-by-iot-enterprise.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Core](policies-in-policy-csp-supported-by-iot-core.md)
|
||||
#### [Policies in Policy CSP supported by Microsoft Surface Hub](policies-in-policy-csp-supported-by-surface-hub.md)
|
||||
#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policies-in-policy-csp-that-can-be-set-using-eas.md)
|
||||
#### [AboveLock](policy-csp-abovelock.md)
|
||||
#### [Accounts](policy-csp-accounts.md)
|
||||
#### [ActiveXControls](policy-csp-activexcontrols.md)
|
||||
|
||||
@ -289,9 +289,9 @@ The following table show the mapping of information to the AppLocker publisher r
|
||||
Here is an example AppLocker publisher rule:
|
||||
|
||||
``` syntax
|
||||
FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Reader" BinaryName="*">
|
||||
<FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Reader" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="*" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</FilePublisherCondition>
|
||||
```
|
||||
|
||||
You can get the publisher name and product name of apps using a web API.
|
||||
@ -299,7 +299,7 @@ You can get the publisher name and product name of apps using a web API.
|
||||
**To find publisher and product name for Microsoft apps in Microsoft Store for Business**
|
||||
|
||||
1. Go to the Microsoft Store for Business website, and find your app. For example, Microsoft OneNote.
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https:<span><\span>//www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, **9wzdncrfhvjl**.
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, **9wzdncrfhvjl**.
|
||||
3. In your browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values.
|
||||
|
||||
<table>
|
||||
@ -313,14 +313,11 @@ You can get the publisher name and product name of apps using a web API.
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/{app ID}/applockerdata</p></td>
|
||||
<td><p><code>https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/{app ID}/applockerdata</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
~~~
|
||||
Here is the example for Microsoft OneNote:
|
||||
|
||||
Request
|
||||
@ -339,7 +336,6 @@ Result
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
~~~
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
|
||||
@ -112,8 +112,8 @@ Example: Export the Debug logs
|
||||
</SyncML>
|
||||
```
|
||||
|
||||
## Collect logs from Windows 10 Mobile devices
|
||||
|
||||
<!--## Collect logs from Windows 10 Mobile devices-->
|
||||
<!--
|
||||
Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs.
|
||||
|
||||
**To collect logs manually**
|
||||
@ -182,11 +182,11 @@ The following table contains a list of common providers and their corresponding
|
||||
| e5fc4a0f-7198-492f-9b0f-88fdcbfded48 | Microsoft-Windows Networking VPN |
|
||||
| e5c16d49-2464-4382-bb20-97a4b5465db9 | Microsoft-Windows-WiFiNetworkManager |
|
||||
|
||||
|
||||
-->
|
||||
|
||||
## Collect logs remotely from Windows 10 Holographic or Windows 10 Mobile devices
|
||||
## Collect logs remotely from Windows 10 Holographic
|
||||
|
||||
For holographic or mobile devices already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md).
|
||||
For holographic already enrolled in MDM, you can remotely collect MDM logs through the MDM channel using the [DiagnosticLog CSP](diagnosticlog-csp.md).
|
||||
|
||||
You can use the DiagnosticLog CSP to enable the ETW provider. The provider ID is 3DA494E4-0FE2-415C-B895-FB5265C5C83B. The following examples show how to enable the ETW provider:
|
||||
|
||||
|
||||
@ -38,6 +38,36 @@ Required. Indicates whether this eUICC is physically present and active. Updated
|
||||
|
||||
Supported operation is Get. Value type is boolean.
|
||||
|
||||
<a href="" id="euicc-isactive"></a>**_eUICC_/PPR1Allowed**
|
||||
Required. Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed.
|
||||
|
||||
Supported operation is Get. Value type is boolean.
|
||||
|
||||
<a href="" id="euicc-isactive"></a>**_eUICC_/PPR1AlreadySet**
|
||||
Required. Indicates whether the eUICC already has a profile with PPR1.
|
||||
|
||||
Supported operation is Get. Value type is boolean.
|
||||
|
||||
<a href="" id="euicc-profiles"></a>**_eUICC_/DownloadServers**
|
||||
Interior node. Represents default SM-DP+ discovery requests.
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="euicc-profiles-iccid"></a>**_eUICC_/DownloadServers/_ServerName_**
|
||||
Interior node. Optional. Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.
|
||||
|
||||
Supported operations are Add, Get, and Delete.
|
||||
|
||||
<a href="" id="euicc-profiles-iccid-state"></a>**_eUICC_/DownloadServers/_ServerName_/DiscoveryState**
|
||||
Required. Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.
|
||||
|
||||
Supported operation is Get. Value type is integer. Default value is 1.
|
||||
|
||||
<a href="" id="euicc-profiles-iccid-isenabled"></a>**_eUICC_/DownloadServers/_ServerName_/AutoEnable**
|
||||
Required. Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created.
|
||||
|
||||
Supported operations are Add, Get, and Replace. Value type is bool.
|
||||
|
||||
<a href="" id="euicc-profiles"></a>**_eUICC_/Profiles**
|
||||
Interior node. Required. Represents all enterprise-owned profiles.
|
||||
|
||||
|
||||
@ -49,7 +49,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<CIS />
|
||||
</CaseSense>
|
||||
<DFType>
|
||||
<MIME>com.microsoft/1.1/MDM/eUICCs</MIME>
|
||||
<MIME>com.microsoft/1.2/MDM/eUICCs</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
@ -58,7 +58,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is meaningful only to the LPA (which associates it with an eUICC ID (EID) in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID). The node name "Default" represents the currently active eUICC.</Description>
|
||||
<Description>Represents information associated with an eUICC. There is one subtree for each known eUICC, created by the Local Profile Assistant (LPA) when the eUICC is first seen. The node name is the eUICC ID (EID). The node name "Default" represents the currently active eUICC.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
@ -79,7 +79,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Identifies an eUICC in an implementation-specific manner, e.g., this could be a SHA-256 hash of the EID.</Description>
|
||||
<Description>The EID.</Description>
|
||||
<DFFormat>
|
||||
<chr />
|
||||
</DFFormat>
|
||||
@ -118,6 +118,139 @@ The XML below if for Windows 10, version 1803.
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PPR1Allowed</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Indicates whether the download of a profile with PPR1 is allowed. If the eUICC already has a profile (regardless of its origin and policy rules associated with it), the download of a profile with PPR1 is not allowed.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PPR1AlreadySet</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Indicates whether the eUICC already has a profile with PPR1.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>DownloadServers</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>Represents default SM-DP+ discovery requests.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName></NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Node specifying the server name for a discovery operation. The node name is the fully qualified domain name of the SM-DP+ server that will be used for profile discovery. Creation of this subtree triggers a discovery request.</Description>
|
||||
<DFFormat>
|
||||
<node />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<ZeroOrMore />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFTitle>ServerName</DFTitle>
|
||||
<DFType>
|
||||
<DDFName></DDFName>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
<Node>
|
||||
<NodeName>DiscoveryState</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<DefaultValue>1</DefaultValue>
|
||||
<Description>Current state of the discovery operation for the parent ServerName (Requested = 1, Executing = 2, Completed = 3, Failed = 4). Queried by the CSP and only updated by the LPA.</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>AutoEnable</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Indicates whether the discovered profile must be enabled automatically after install. This must be set by the MDM when the ServerName subtree is created.</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>Profiles</NodeName>
|
||||
<DFProperties>
|
||||
@ -145,6 +278,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<Add />
|
||||
<Delete />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Node representing an enterprise-owned eUICC profile. The node name is the ICCID of the profile (which is a unique identifier). Creation of this subtree triggers an AddProfile request by the LPA (which installs the profile on the eUICC). Removal of this subtree triggers the LPA to delete the profile (if resident on the eUICC).</Description>
|
||||
<DFFormat>
|
||||
@ -167,6 +301,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Fully qualified domain name of the SM-DP+ that can download this profile. Must be set by the MDM when the ICCID subtree is created.</Description>
|
||||
<DFFormat>
|
||||
@ -192,6 +327,7 @@ The XML below if for Windows 10, version 1803.
|
||||
<AccessType>
|
||||
<Add />
|
||||
<Get />
|
||||
<Replace />
|
||||
</AccessType>
|
||||
<Description>Matching ID (activation code token) for profile download. Must be set by the MDM when the ICCID subtree is created.</Description>
|
||||
<DFFormat>
|
||||
@ -256,6 +392,70 @@ The XML below if for Windows 10, version 1803.
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PPR1Set</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This profile policy rule indicates whether disabling of this profile is not allowed (true if not allowed, false otherwise).</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>PPR2Set</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<Description>This profile policy rule indicates whether deletion of this profile is not allowed (true if not allowed, false otherwise).</Description>
|
||||
<DFFormat>
|
||||
<bool />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
<Node>
|
||||
<NodeName>ErrorDetail</NodeName>
|
||||
<DFProperties>
|
||||
<AccessType>
|
||||
<Get />
|
||||
</AccessType>
|
||||
<DefaultValue>0</DefaultValue>
|
||||
<Description>Detailed error if the profile download and install procedure failed (None = 0, CardGeneralFailure = 1, ConfirmationCodeMissing = 3, ForbiddenByPolicy = 5, InvalidMatchingId = 6, NoEligibleProfileForThisDevice = 7, NotEnoughSpaceOnCard = 8, ProfileEidMismatch = 10, ProfileNotAvailableForNewBinding = 11, ProfileNotReleasedByOperator = 12, RemoteServerGeneralFailure = 13, RemoteServerUnreachable = 14).</Description>
|
||||
<DFFormat>
|
||||
<int />
|
||||
</DFFormat>
|
||||
<Occurrence>
|
||||
<One />
|
||||
</Occurrence>
|
||||
<Scope>
|
||||
<Dynamic />
|
||||
</Scope>
|
||||
<DFType>
|
||||
<MIME>text/plain</MIME>
|
||||
</DFType>
|
||||
</DFProperties>
|
||||
</Node>
|
||||
</Node>
|
||||
</Node>
|
||||
<Node>
|
||||
|
||||
@ -177,6 +177,10 @@ ms.localizationpriority: medium
|
||||
<dd>
|
||||
<a href="#browser-showmessagewhenopeningsitesininternetexplorer">Browser/ShowMessageWhenOpeningSitesInInternetExplorer</a>
|
||||
</dd>
|
||||
|
||||
<dd>
|
||||
<a href="#browser-suppressedgedeprecationnotification">Browser/SuppressEdgeDeprecationNotification</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#browser-syncfavoritesbetweenieandmicrosoftedge">Browser/SyncFavoritesBetweenIEAndMicrosoftEdge</a>
|
||||
</dd>
|
||||
@ -4069,6 +4073,74 @@ Most restricted value: 0
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="browser-suppressedgedeprecationnotification"></a>**Browser/SuppressEdgeDeprecationNotification**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy allows Enterprise Admins to turn off the notification for company devices that the Edge Legacy browser is no longer supported after 3/9/2021 to avoid confusion for their enterprise users and reduce help desk calls.
|
||||
By default, a notification will be presented to the user informing them of this upon application startup.
|
||||
With this policy, you can either allow (default) or suppress this notification.
|
||||
|
||||
> [!NOTE]
|
||||
> This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Suppress Edge Deprecation Notification*
|
||||
- GP name: *SuppressEdgeDeprecationNotification*
|
||||
- GP path: *Windows Components/Microsoft Edge*
|
||||
- GP ADMX file name: *MicrosoftEdge.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
Supported values:
|
||||
|
||||
- 0 (default) – Allowed. Notification will be shown at application startup.
|
||||
- 1 – Prevented/not allowed.
|
||||
|
||||
<hr/>
|
||||
<!--Policy-->
|
||||
<a href="" id="browser-syncfavoritesbetweenieandmicrosoftedge"></a>**Browser/SyncFavoritesBetweenIEAndMicrosoftEdge**
|
||||
|
||||
|
||||
@ -78,7 +78,8 @@ Specifies the time zone to be applied to the device. This is the standard Window
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
Value type is String. Supported values:
|
||||
- Name of Standard Time Zone - for example, Pacific Standard Time, Mountain Standard Time.
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
@ -101,4 +102,3 @@ Footnotes:
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.author: dansimp
|
||||
- **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you will need to [enable updates through the Microsoft Store](https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store).
|
||||
|
||||
## Set up and configure the Bing Answers feature
|
||||
Bing Answers provides fast, authoritative results to search queries based on search terms. When the Bing Answers feature is enabled, users will be able to ask Cortana web-related questions in the Cortana in Windows app, such as "What's the current weather?" or "Who is the president of the U.S.?," and get a response, based on public results from Bing.com.
|
||||
Bing Answers provides fast, authoritative results to search queries based on search terms. If you enable this policy setting for the Cortana Windows app or Microsoft Teams display, users can ask Cortana web-related questions such as “What’s the current weather?” or “What time is it in Tokyo?”
|
||||
|
||||
The above experience is powered by Microsoft Bing, and Cortana sends the user queries to Bing. The use of Microsoft Bing is governed by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) and [Privacy Statement](https://privacy.microsoft.com/en-US/privacystatement).
|
||||
|
||||
@ -46,4 +46,4 @@ When a user enters a search query (by speech or text), Cortana evaluates if the
|
||||
Bing Answers is enabled by default for all users. However, admins can configure and change this for specific users and user groups in their organization.
|
||||
|
||||
## How the Bing Answer policy configuration is applied
|
||||
Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes.
|
||||
Before a query is sent to Bing for a search of public results from Bing.com, the Bing Answers service checks with the Office Cloud Policy Service to see if there are any policy configurations that pertain to the user for allowing Bing Answers to respond to questions users ask Cortana. If the user is a member of an AAD group that is assigned that policy configuration, then the appropriate policy settings are applied and a check is made again in 10 minutes.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Alter Windows 10 Start and taskbar via mobile device management
|
||||
description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and tasbkar layout to users.
|
||||
description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and taskbar layout to users.
|
||||
ms.assetid: F487850D-8950-41FB-9B06-64240127C1E4
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -51,6 +51,9 @@ Two features enable Start layout control:
|
||||
|
||||
- In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile.
|
||||
|
||||
>[!NOTE]
|
||||
>Please do not include XML Prologs like \<?xml version="1.0" encoding="utf-8"?\> in the Start layout XML file. The settings may not be reflected correctly.
|
||||
|
||||
## <a href="" id="bkmk-domaingpodeployment"></a>Create a policy for your customized Start layout
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
@ -85,23 +85,27 @@ You can configure Windows to be in shared PC mode in a couple different ways:
|
||||
|
||||
- Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp). To setup a shared device policy for Windows 10 in Intune, complete the following steps:
|
||||
|
||||
1. Go to the [Microsoft Endpoint Manager portal](https://endpoint.microsoft.com/#home).
|
||||
2. Select **Devices** from the navigation.
|
||||
3. Under **Policy**, select **Configuration profiles**.
|
||||
4. Select **Create profile**.
|
||||
5. From the **Platform** menu, select **Windows 10 and later**.
|
||||
6. From the **Profile** menu, select **Shared multi-user device**.
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Select **Devices** > **Windows** > **Configuration profiles** > **Create profile**.
|
||||
3. Enter the following properties:
|
||||
|
||||
|
||||
- **Platform**: Select **Windows 10 and later**.
|
||||
- **Profile**: Select **Templates** > **Shared multi-user device**.
|
||||
|
||||
7. Select **Create**.
|
||||
8. Enter a name for the policy (e.g. My Win10 Shared devices policy). You can optionally add a description should you wish to do so.
|
||||
9. Select **Next**.
|
||||
10. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**.
|
||||
4. Select **Create**.
|
||||
5. In **Basics**, enter the following properties:
|
||||
|
||||
- **Name**: Enter a descriptive name for the new profile.
|
||||
- **Description**: Enter a description for the profile. This setting is optional, but recommended.
|
||||
|
||||
6. Select **Next**.
|
||||
7. In **Configuration settings**, depending on the platform you chose, the settings you can configure are different. Choose your platform for detailed settings:
|
||||
|
||||
8. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**.
|
||||
|
||||
|
||||
|
||||
11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**.
|
||||
9. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 4**.
|
||||
|
||||
- A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**.
|
||||
|
||||
|
||||
@ -21,18 +21,18 @@ ms.topic: article
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT).
|
||||
This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the **Microsoft Deployment Toolkit (MDT)**.
|
||||
|
||||
We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules.
|
||||
We will prepare for this by creating an **MDT** deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of both processes. We will configure **Active Directory** permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules.
|
||||
|
||||
For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 and PC0005.
|
||||
For the purposes of this topic, we will use four computers: **DC01**, **MDT01**, **HV01**, and **PC0005**.
|
||||
|
||||
- DC01 is a domain controller
|
||||
- MDT01 is a domain member server
|
||||
- HV01 is a Hyper-V server
|
||||
- PC0005 is a blank device to which we will deploy Windows 10
|
||||
- **DC01** is a domain controller
|
||||
- **MDT01** is a domain member server
|
||||
- **HV01** is a Hyper-V server
|
||||
- **PC0005** is a blank device to which we will deploy Windows 10
|
||||
|
||||
MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment.
|
||||
**MDT01** and **PC0005** are members of the domain contoso.com for the fictitious Contoso Corporation. **HV01** is used to test the deployment of **PC0005** in a virtual environment.
|
||||
|
||||
|
||||
|
||||
@ -45,14 +45,14 @@ These steps will show you how to configure an Active Directory account with the
|
||||
|
||||
On **DC01**:
|
||||
|
||||
1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on DC01. This script configures permissions to allow the MDT_JD account to manage computer accounts in the contoso > Computers organizational unit.
|
||||
2. Create the MDT_JD service account by running the following command from an elevated Windows PowerShell prompt:
|
||||
1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on **DC01**. This script configures permissions to allow the **MDT_JD** account to manage computer accounts in the contoso > Computers organizational unit.
|
||||
2. Create the **MDT_JD** service account by running the following command from an elevated **Windows PowerShell prompt**:
|
||||
|
||||
```powershell
|
||||
New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true
|
||||
```
|
||||
|
||||
3. Next, run the Set-OuPermissions script to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated Windows PowerShell prompt:
|
||||
3. Next, run the **Set-OuPermissions script** to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated **Windows PowerShell prompt**:
|
||||
|
||||
```powershell
|
||||
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force
|
||||
@ -76,7 +76,7 @@ The following is a list of the permissions being granted:
|
||||
|
||||
## Step 2: Set up the MDT production deployment share
|
||||
|
||||
Next, create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the MDT01 server.
|
||||
Next, create a new **MDT** deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the **MDT01** server.
|
||||
|
||||
### Create the MDT production deployment share
|
||||
|
||||
@ -85,21 +85,21 @@ On **MDT01**:
|
||||
The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image:
|
||||
|
||||
1. Ensure you are signed on as: contoso\administrator.
|
||||
2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**.
|
||||
2. In the **Deployment Workbench** console, right-click **Deployment Shares** and select **New Deployment Share**.
|
||||
3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**.
|
||||
4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**.
|
||||
5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**.
|
||||
6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**.
|
||||
7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
|
||||
7. Using **File Explorer**, verify that you can access the **\\\\MDT01\\MDTProduction$** share.
|
||||
|
||||
### Configure permissions for the production deployment share
|
||||
|
||||
To read files in the deployment share, you need to assign NTFS and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTProduction** folder
|
||||
To read files in the deployment share, you need to assign **NTFS** and **SMB** permissions to the **MDT Build Account (MDT\_BA)** for the **D:\\MDTProduction** folder.
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. Ensure you are signed in as **contoso\\administrator**.
|
||||
2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt:
|
||||
2. Modify the **NTFS** permissions for the **D:\\MDTProduction** folder by running the following command in an elevated **Windows PowerShell prompt**:
|
||||
|
||||
``` powershell
|
||||
icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)'
|
||||
@ -112,33 +112,33 @@ The next step is to add a reference image into the deployment share with the set
|
||||
|
||||
### Add the Windows 10 Enterprise x64 RTM custom image
|
||||
|
||||
In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01.
|
||||
In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on **MDT01**.
|
||||
|
||||
1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**.
|
||||
1. Using the **Deployment Workbench**, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a **folder** named **Windows 10**.
|
||||
2. Right-click the **Windows 10** folder and select **Import Operating System**.
|
||||
3. On the **OS Type** page, select **Custom image file** and click **Next**.
|
||||
4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**.
|
||||
5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**.
|
||||
6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**.
|
||||
7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**.
|
||||
7. After adding the **Operating System**, double-click the added **Operating System** name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**.
|
||||
|
||||
>[!NOTE]
|
||||
>The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image.
|
||||
> [!NOTE]
|
||||
> The reason for adding the setup files has changed since earlier versions of **MDT**. **MDT 2010** used the setup files to install Windows. **MDT** uses the **DISM** command to apply the image; however, you still need the **setup files** because some components in **roles and features** are stored outside the main image.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Step 4: Add an application
|
||||
|
||||
When you configure your MDT Build Lab deployment share, you can also add applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example.
|
||||
When you configure your **MDT Build Lab deployment** share, you can also add **applications** to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the **MDT Production deployment** share using **Adobe Reader** as an example.
|
||||
|
||||
### Create the install: Adobe Reader DC
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC1902120058_en_US.exe) to **D:\\setup\\adobe** on MDT01.
|
||||
2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC1902120058_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
|
||||
3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node.
|
||||
1. Download the Enterprise distribution version of [**Adobe Acrobat Reader DC**](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100120140_en_US.exe) to **D:\\setup\\adobe** on MDT01.
|
||||
2. Extract the **.exe** file that you downloaded to a **.msi** (ex: .\AcroRdrDC2100120140_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne).
|
||||
3. In the **Deployment Workbench**, expand the **MDT Production** node and navigate to the **Applications** node.
|
||||
4. Right-click the **Applications** node, and create a new folder named **Adobe**.
|
||||
5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**.
|
||||
6. On the **Application Type** page, select the **Application with source files** option and click **Next**.
|
||||
@ -153,7 +153,7 @@ The Adobe Reader application added to the Deployment Workbench.
|
||||
|
||||
## Step 5: Prepare the drivers repository
|
||||
|
||||
In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples:
|
||||
In order to deploy Windows 10 with **MDT** successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot images and operating system, using the following hardware models as examples:
|
||||
- Lenovo ThinkPad T420
|
||||
- Dell Latitude 7390
|
||||
- HP EliteBook 8560w
|
||||
@ -166,19 +166,19 @@ For boot images, you need to have storage and network drivers; for the operating
|
||||
|
||||
### Create the driver source structure in the file system
|
||||
|
||||
The key to successful management of drivers for MDT, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use.
|
||||
The key to successful management of drivers for **MDT**, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use.
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
> [!IMPORTANT]
|
||||
> In the steps below, it is critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system.
|
||||
|
||||
1. Using File Explorer, create the **D:\\drivers** folder.
|
||||
1. Using **File Explorer**, create the **D:\\drivers** folder.
|
||||
2. In the **D:\\drivers** folder, create the following folder structure:
|
||||
1. WinPE x86
|
||||
2. WinPE x64
|
||||
3. Windows 10 x64
|
||||
3. In the new Windows 10 x64 folder, create the following folder structure:
|
||||
1. **WinPE x86**
|
||||
2. **WinPE x64**
|
||||
3. **Windows 10 x64**
|
||||
3. In the new **Windows 10 x64** folder, create the following folder structure:
|
||||
- Dell Inc
|
||||
- Latitude E7450
|
||||
- Hewlett-Packard
|
||||
@ -193,12 +193,12 @@ On **MDT01**:
|
||||
|
||||
### Create the logical driver structure in MDT
|
||||
|
||||
When you import drivers to the MDT driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench.
|
||||
1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node.
|
||||
When you import drivers to the **MDT driver repository**, **MDT** creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench.
|
||||
1. On **MDT01**, using Deployment Workbench, select the **Out-of-Box Drivers** node.
|
||||
2. In the **Out-Of-Box Drivers** node, create the following folder structure:
|
||||
1. WinPE x86
|
||||
2. WinPE x64
|
||||
3. Windows 10 x64
|
||||
1. **WinPE x86**
|
||||
2. **WinPE x64**
|
||||
3. **Windows 10 x64**
|
||||
3. In the **Windows 10 x64** folder, create the following folder structure:
|
||||
- Dell Inc
|
||||
- Latitude E7450
|
||||
@ -209,7 +209,7 @@ When you import drivers to the MDT driver repository, MDT creates a single insta
|
||||
- Microsoft Corporation
|
||||
- Surface Laptop
|
||||
|
||||
The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in Windows PowerShell:
|
||||
The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in an elevated **Windows PowerShell prompt**:
|
||||
|
||||
``` powershell
|
||||
Get-WmiObject -Class:Win32_ComputerSystem
|
||||
@ -220,7 +220,7 @@ Or, you can use this command in a normal command prompt:
|
||||
wmic csproduct get name
|
||||
```
|
||||
|
||||
If you want a more standardized naming convention, try the ModelAliasExit.vbs script from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](https://go.microsoft.com/fwlink/p/?LinkId=619536).
|
||||
If you want a more standardized naming convention, try the **ModelAliasExit.vbs script** from the Deployment Guys blog post entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](https://go.microsoft.com/fwlink/p/?LinkId=619536).
|
||||
|
||||
|
||||
|
||||
@ -229,20 +229,20 @@ The Out-of-Box Drivers structure in the Deployment Workbench.
|
||||
### Create the selection profiles for boot image drivers
|
||||
|
||||
By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles.
|
||||
The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice.
|
||||
The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate **Windows 10** drivers for your device, a **Windows 7** or **Windows 8.1** driver will most likely work, but Windows 10 drivers should be your first choice.
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**.
|
||||
2. In the New Selection Profile Wizard, create a selection profile with the following settings:
|
||||
1. Selection Profile name: WinPE x86
|
||||
2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers.
|
||||
3. Click **Next**, **Next** and **Finish**.
|
||||
1. In the **Deployment Workbench**, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**.
|
||||
2. In the **New Selection Profile Wizard**, create a **selection profile** with the following settings:
|
||||
1. Selection Profile name: **WinPE x86**
|
||||
2. Folders: Select the **WinPE x86 folder** in **Out-of-Box Drivers**.
|
||||
3. Click **Next**, **Next**, and **Finish**.
|
||||
3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**.
|
||||
4. In the New Selection Profile Wizard, create a selection profile with the following settings:
|
||||
1. Selection Profile name: WinPE x64
|
||||
2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers.
|
||||
3. Click **Next**, **Next** and **Finish**.
|
||||
4. In the **New Selection Profile Wizard**, create a **selection profile** with the following settings:
|
||||
1. Selection Profile name: **WinPE x64**
|
||||
2. Folders: Select the **WinPE x64 folder** in **Out-of-Box Drivers**.
|
||||
3. Click **Next**, **Next**, and **Finish**.
|
||||
|
||||
|
||||
|
||||
@ -250,22 +250,21 @@ Creating the WinPE x64 selection profile.
|
||||
|
||||
### Extract and import drivers for the x64 boot image
|
||||
|
||||
Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image.
|
||||
**Windows PE** supports all the hardware models that we have, but here you learn how to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image.
|
||||
|
||||
On **MDT01**:
|
||||
|
||||
1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)).
|
||||
2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder.
|
||||
a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates.
|
||||
3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
|
||||
2. Extract **PROWinx64.exe** to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. Note that extracting the **.exe** file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the **.exe** terminates.
|
||||
3. Using **File Explorer**, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
|
||||
4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder.
|
||||
5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**.
|
||||
5. In the **Deployment Workbench**, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, select **Import Drivers**, and use the following driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**.
|
||||
|
||||
### Download, extract, and import drivers
|
||||
|
||||
### For the Lenovo ThinkStation P500
|
||||
|
||||
For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6.
|
||||
For the **ThinkStation P500** model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -81,6 +81,9 @@ This table shows the correct sequence for applying the various tasks to the file
|
||||
|Add .NET and .NET cumulative updates | | | 24 |
|
||||
|Export image | 8 | 17 | 25 |
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in February 2021, the latest cumulative update and servicing stack update will be combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 18 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates).
|
||||
|
||||
### Multiple Windows editions
|
||||
|
||||
The main operating system file (install.wim) contains multiple editions of Windows 10. It’s possible that only an update for a given edition is required to deploy it, based on the index. Or, it might be that all editions need an update. Further, ensure that languages are installed before Features on Demand, and the latest cumulative update is always applied last.
|
||||
|
||||
@ -29,8 +29,6 @@ Servicing stack updates provide fixes to the servicing stack, the component that
|
||||
|
||||
Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes.
|
||||
|
||||
For information about some changes to servicing stack updates, see [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) on the Windows IT Pro blog.
|
||||
|
||||
## When are they released?
|
||||
|
||||
Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical."
|
||||
@ -44,7 +42,6 @@ Both Windows 10 and Windows Server use the cumulative update mechanism, in which
|
||||
|
||||
Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update.
|
||||
|
||||
|
||||
## Is there any special guidance?
|
||||
|
||||
Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.
|
||||
@ -58,3 +55,7 @@ Typically, the improvements are reliability and performance improvements that do
|
||||
* Servicing stack update releases are specific to the operating system version (build number), much like quality updates.
|
||||
* Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001).
|
||||
* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine.
|
||||
|
||||
|
||||
## Simplifying on-premises deployment of servicing stack updates
|
||||
With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update will include the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you will only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update will be available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382.
|
||||
|
||||
@ -66,6 +66,9 @@ To find your CommercialID within Azure:
|
||||
|
||||
Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are two ways to configure devices to use Update Compliance.
|
||||
|
||||
> [!NOTE]
|
||||
> If you use or plan to use [Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/overview), follow the steps in [Enroll devices in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/enroll-devices) to also enroll devices to Update Compliance. You should be aware that the Commercial ID and Log Analytics workspace must be the same for both Desktop Analytics and Update Compliance.
|
||||
|
||||
> [!NOTE]
|
||||
> After configuring devices via one of the two methods below, it can take up to 72 hours before devices are visible in the solution. Until then, Update Compliance will indicate it is still assessing devices.
|
||||
|
||||
|
||||
@ -134,7 +134,7 @@ For more details, check out the [Adopting Windows as a Service at Microsoft](htt
|
||||
|
||||
**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination.
|
||||
|
||||
**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound traffic through your firewall yourself. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data).
|
||||
**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound and outbound traffic through your firewall yourself. If you don't allow inbound and outbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data).
|
||||
|
||||
If you set up Delivery Optimization to create peer groups that include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets), it will use Teredo. For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up.
|
||||
|
||||
|
||||
@ -47,11 +47,14 @@ Windows Update for Business enables an IT administrator to receive and manage a
|
||||
Windows Update for Business provides management policies for several types of updates to Windows 10 devices:
|
||||
|
||||
- **Feature updates:** Previously referred to as "upgrades," feature updates contain not only security and quality revisions, but also significant feature additions and changes. Feature updates are released semi-annually in the fall and in the spring.
|
||||
- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as updates for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and you can set devices to receive such updates (or not) along with their Windows updates.
|
||||
- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates.
|
||||
- **Driver updates:** Updates for non-Microsoft drivers that are relevant to your devices. Driver updates are on by default, but you can use Windows Update for Business policies to turn them off if you prefer.
|
||||
- **Microsoft product updates**: Updates for other Microsoft products, such as versions of Office that are installed by using Windows Installer (MSI). Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business. Product updates are off by default. You can turn them on by using Windows Update for Business policies.
|
||||
- **Microsoft product updates:** Updates for other Microsoft products, such as Visual Studio or versions of Microsoft Office that are installed by using Windows Installer (MSI). These updates are treated the same way as quality updates. Microsoft product updates are off by default, but you can turn them on with Windows Update for Business policies.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business.
|
||||
|
||||
## Offering
|
||||
You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period.
|
||||
|
||||
@ -126,7 +129,7 @@ The large number of different policies offered for Windows 10 can be overwhelmin
|
||||
The Update Baseline toolkit makes it easy by providing a single command for IT Admins to apply the Update Baseline to devices. You can get the Update Baseline toolkit from the [Download Center](https://www.microsoft.com/download/details.aspx?id=101056).
|
||||
|
||||
>[!NOTE]
|
||||
>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices when.
|
||||
>The Update Baseline toolkit is available only for Group Policy. Update Baseline does not affect your offering policies, whether you’re using deferrals or target version to manage which updates are offered to your devices and when.
|
||||
|
||||
<!--
|
||||
|
||||
|
||||
@ -42,29 +42,30 @@ The following resources provide additional information about using Windows Updat
|
||||
``` console
|
||||
cmd
|
||||
```
|
||||
2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
2. Stop the **BITS service**, the **Windows Update service** and the **Cryptographic service**. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
net stop bits
|
||||
net stop wuauserv
|
||||
net stop cryptsvc
|
||||
```
|
||||
3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
3. Delete the **qmgr\*.dat** files. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
``` console
|
||||
Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat"
|
||||
```
|
||||
4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above.
|
||||
1. Rename the following folders to *.BAK:
|
||||
``` console
|
||||
%systemroot%\SoftwareDistribution\DataStore
|
||||
%systemroot%\SoftwareDistribution\Download
|
||||
%systemroot%\system32\catroot2
|
||||
%Systemroot%\SoftwareDistribution\DataStore
|
||||
%Systemroot%\SoftwareDistribution\Download
|
||||
%Systemroot%\System32\catroot2
|
||||
```
|
||||
To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
Ren %systemroot%\SoftwareDistribution\DataStore *.bak
|
||||
Ren %systemroot%\SoftwareDistribution\Download *.bak
|
||||
Ren %systemroot%\system32\catroot2 *.bak
|
||||
Ren %Systemroot%\SoftwareDistribution\DataStore DataStore.bak
|
||||
Ren %Systemroot%\SoftwareDistribution\Download Download.bak
|
||||
Ren %Systemroot%\System32\catroot2 catroot2.bak
|
||||
```
|
||||
2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
2. Reset the **BITS service** and the **Windows Update service** to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
|
||||
sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
|
||||
@ -73,7 +74,7 @@ The following resources provide additional information about using Windows Updat
|
||||
``` console
|
||||
cd /d %windir%\system32
|
||||
```
|
||||
6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
6. Reregister the **BITS** files and the **Windows Update** files. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
|
||||
``` console
|
||||
regsvr32.exe atl.dll
|
||||
@ -114,7 +115,7 @@ The following resources provide additional information about using Windows Updat
|
||||
regsvr32.exe wuwebv.dll
|
||||
```
|
||||
|
||||
7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
7. Reset **Winsock**. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
``` console
|
||||
netsh winsock reset
|
||||
```
|
||||
@ -122,13 +123,13 @@ The following resources provide additional information about using Windows Updat
|
||||
``` console
|
||||
proxycfg.exe -d
|
||||
```
|
||||
9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
9. Restart the **BITS service**, the **Windows Update service** and the **Cryptographic service**. To do this, type the following commands at a command prompt. Press ENTER after you type each command.
|
||||
``` console
|
||||
net start bits
|
||||
|
||||
net start wuauserv
|
||||
net start wuauserv
|
||||
net start cryptsvc
|
||||
```
|
||||
10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
10. If you are running Windows Vista or Windows Server 2008, clear the **BITS** queue. To do this, type the following command at a command prompt, and then press ENTER:
|
||||
``` console
|
||||
bitsadmin.exe /reset /allusers
|
||||
```
|
||||
|
||||
@ -101,7 +101,7 @@ You can use these variables within sections in the .xml files with `context=User
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>CSIDL_COMMON_STARTUP</strong></p></td>
|
||||
<td align="left"><p>The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.</p></td>
|
||||
<td align="left"><p>The file-system directory that contains the programs that appear in the <strong>Startup</strong> folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>CSIDL_COMMON_TEMPLATES</strong></p></td>
|
||||
@ -116,7 +116,7 @@ You can use these variables within sections in the .xml files with `context=User
|
||||
<td align="left"><p>Refers to the Appdata folder inside %<strong>DEFAULTUSERPROFILE</strong>%.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>C<strong>SIDL_DEFAULT_LOCAL_APPDATA</strong></p></td>
|
||||
<td align="left"><p><strong>CSIDL_DEFAULT_LOCAL_APPDATA</strong></p></td>
|
||||
<td align="left"><p>Refers to the local Appdata folder inside %<strong>DEFAULTUSERPROFILE</strong>%.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
@ -319,7 +319,7 @@ You can use these variables in the .xml files within sections with `context=User
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>CSIDL_CONTACTS</strong></p></td>
|
||||
<td align="left"><p>This refers to the Contacts folder in %<strong>CSIDL_PROFILE</strong>%.</p></td>
|
||||
<td align="left"><p>This refers to the Contacts folder in <strong>%CSIDL_PROFILE%</strong>.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>CSIDL_CONTROLS</strong></p></td>
|
||||
@ -339,7 +339,7 @@ You can use these variables in the .xml files within sections with `context=User
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>CSIDL_DRIVES</strong></p></td>
|
||||
<td align="left"><p>The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.</p></td>
|
||||
<td align="left"><p>The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and <strong>Control Panel</strong>. The folder may also contain mapped network drives.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>CSIDL_FAVORITES</strong></p></td>
|
||||
@ -379,7 +379,7 @@ You can use these variables in the .xml files within sections with `context=User
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p><strong>CSIDL_NETHOOD</strong></p></td>
|
||||
<td align="left"><p>A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.</p></td>
|
||||
<td align="left"><p>A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as <strong>CSIDL_NETWORK</strong>, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p><strong>CSIDL_NETWORK</strong></p></td>
|
||||
@ -467,5 +467,3 @@ You can use these variables in the .xml files within sections with `context=User
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -29,6 +29,9 @@ ms.topic: article
|
||||
>- Windows Server 2012
|
||||
>- Windows Server 2016
|
||||
>- Windows Server 2019
|
||||
>- Office 2013*
|
||||
>- Office 2016*
|
||||
>- Office 2019*
|
||||
|
||||
**Looking for retail activation?**
|
||||
|
||||
@ -97,6 +100,17 @@ When a reactivation event occurs, the client queries AD DS for the activation o
|
||||
1. Activate your KMS host key by phone or online (Figure 15).
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> To activate a KMS Host Key (CSVLK) for Microsoft Office, you need to install the version-specific Office Volume License Pack on the server where the Volume Activation Server Role is installed.
|
||||
|
||||
|
||||
- [Office 2013 VL pack](https://www.microsoft.com/download/details.aspx?id=35584)
|
||||
|
||||
- [Office 2016 VL pack](https://www.microsoft.com/download/details.aspx?id=49164)
|
||||
|
||||
- [Office 2019 VL pack](https://www.microsoft.com/download/details.aspx?id=57342)
|
||||
|
||||
|
||||
**Figure 15**. Choosing how to activate your product
|
||||
|
||||
@ -115,6 +129,8 @@ To verify your Active Directory-based activation configuration, complete the fol
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used.
|
||||
> To manage individual activations or apply multiple (mass) activations, please consider using the [VAMT](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-management-tool).
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
|
||||
@ -91,6 +91,7 @@ For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products &
|
||||
- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded.
|
||||
- Azure Active Directory (Azure AD) available for identity management.
|
||||
- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported.
|
||||
- Windows 10 per user licensing is not available for per device based licensing.
|
||||
|
||||
For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md).
|
||||
|
||||
|
||||
@ -85,6 +85,7 @@ The following methodology was used to derive these network endpoints:
|
||||
|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTP|go.microsoft.com|
|
||||
|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
|
||||
||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net|
|
||||
||The following endpoint is needed to load the content in the Microsoft Store app.|HTTPS|livetileedge.dsx.mp.microsoft.com|
|
||||
||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2/HTTPS|*.wns.windows.com|
|
||||
||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com|
|
||||
||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com|
|
||||
|
||||
@ -42,9 +42,9 @@ As the depth and breadth of protections provided by Windows Defender Credential
|
||||
### Saved Windows Credentials Protected
|
||||
|
||||
Starting with Windows 10, version 1511, domain credentials that are stored with Credential Manager are protected with Windows Defender Credential Guard. Credential Manager allows you to store three types of credentials: Windows credentials, certificate-based credentials, and generic credentials. Generic credentials such as user names and passwords that you use to log on to websites are not protected since the applications require your cleartext password. If the application does not need a copy of the password, they can save domain credentials as Windows credentials that are protected. Windows credentials are used to connect to other computers on a network. The following considerations apply to the Windows Defender Credential Guard protections for Credential Manager:
|
||||
- Windows credentials saved by Remote Desktop Client cannot be sent to a remote host. Attempts to use saved Windows credentials fail, displaying the error message "Logon attempt failed."
|
||||
- Applications that extract Windows credentials fail.
|
||||
- When credentials are backed up from a PC that has Windows Defender Credential Guard enabled, the Windows credentials cannot be restored. If you need to back up your credentials, you must do this before you enable Windows Defender Credential Guard. Otherwise, you cannot restore those credentials.
|
||||
* Windows credentials saved by Remote Desktop Client cannot be sent to a remote host. Attempts to use saved Windows credentials fail, displaying the error message "Logon attempt failed."
|
||||
* Applications that extract Windows credentials fail.
|
||||
* When credentials are backed up from a PC that has Windows Defender Credential Guard enabled, the Windows credentials cannot be restored. If you need to back up your credentials, you must do this before you enable Windows Defender Credential Guard. Otherwise, you cannot restore those credentials.
|
||||
|
||||
## Clearing TPM Considerations
|
||||
Virtualization-based Security (VBS) uses the TPM to protect its key. So when the TPM is cleared then the TPM protected key used to encrypt VBS secrets is lost.
|
||||
|
||||
@ -35,7 +35,7 @@ ms.reviewer:
|
||||
The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment.
|
||||
|
||||
>[!IMPORTANT]
|
||||
> The Microsoft PIN Reset service only works with **Enterprise Edition** for Windows 10, version 1709 to 1809. The feature works with **Enterprise Edition** and **Pro** edition with Windows 10, version 1903 and newer.
|
||||
> The Microsoft PIN reset service only works with **Enterprise Edition** for Windows 10, version 1709 to 1809. The feature works with **Enterprise Edition** and **Pro Edition** with Windows 10, version 1903 and later.
|
||||
|
||||
### Onboarding the Microsoft PIN reset service to your Intune tenant
|
||||
|
||||
@ -49,8 +49,10 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se
|
||||
3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant.
|
||||
4. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant.
|
||||
|
||||
5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant.
|
||||
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
localizationpriority: medium
|
||||
ms.date: 08/20/2018
|
||||
ms.date: 02/19/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
# Configure Hybrid Windows Hello for Business: Group Policy
|
||||
@ -55,7 +55,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv
|
||||
7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**.
|
||||
8. In the details pane, right-click **Certificate Services Client <20> Auto-Enrollment** and select **Properties**.
|
||||
9. Select **Enabled** from the **Configuration Model** list.
|
||||
10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box.
|
||||
10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box.
|
||||
11. Select the **Update certificates that use certificate templates** check box.
|
||||
12. Click **OK**. Close the **Group Policy Management Editor**.
|
||||
|
||||
|
||||
@ -82,6 +82,9 @@ Microsoft recommends that BitLocker Device Encryption be enabled on any systems
|
||||
|
||||
Administrators can manage domain-joined devices that have BitLocker Device Encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, BitLocker Device Encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required.
|
||||
|
||||
> [!NOTE]
|
||||
> BitLocker Device Encryption uses the XTS-AES 128-bit encryption method. In case you need to use a different encryption method and/or cipher strength, the device must be configured and decrypted (if already encrypted) first. After that, different BitLocker settings can be applied.
|
||||
|
||||
## Used Disk Space Only encryption
|
||||
|
||||
BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted. In that case, traces of the confidential data could remain on portions of the drive marked as unused.
|
||||
|
||||
@ -429,7 +429,8 @@
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareInventory](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventory-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Change history for [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)"
|
||||
title: "Change history for [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)"
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
description: This topic lists new and updated topics in the Defender for Endpoint content set.
|
||||
|
||||
@ -20,13 +20,13 @@ ms.technology: mde
|
||||
# Threat Protection
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
[Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Defender for Endpoint protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture.
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
> [!TIP]
|
||||
> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/).
|
||||
|
||||
@ -25,14 +25,16 @@ MBSA was largely used in situations where neither Microsoft Update nor a local W
|
||||
A script can help you with an alternative to MBSA’s patch-compliance checking:
|
||||
|
||||
- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline), which includes a sample .vbs script.
|
||||
For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be).
|
||||
|
||||
For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0).
|
||||
|
||||
For example:
|
||||
|
||||
[](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline)
|
||||
[](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be)
|
||||
[](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0/Content/Scan-UpdatesOffline.ps1)
|
||||
|
||||
The preceding scripts leverage the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it.
|
||||
The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) ([wsusscn2.cab](https://go.microsoft.com/fwlink/?LinkID=74689)) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it.
|
||||
|
||||
The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers.
|
||||
|
||||
## More Information
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using the Microsoft Defender AV Assessment section in the Update Compliance add-in.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
This article describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you might encounter when using the Microsoft Defender AV.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can perform various Microsoft Defender Antivirus functions with the dedicated command-line tool *mpcmdrun.exe*. This utility is useful when you want to automate Microsoft Defender Antivirus use. You can find the utility in `%ProgramFiles%\Windows Defender\MpCmdRun.exe`. You must run it from a command prompt.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can manage and configure Microsoft Defender Antivirus with the following tools:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
## Use Microsoft Intune to configure scanning options
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Block at first sight provides a way to detect and block new malware within seconds. This protection is enabled by default when certain prerequisite settings are enabled. These settings include cloud-delivered protection, a specified sample submission timeout (such as 50 seconds), and a file-blocking level of high. In most enterprise organizations, these settings are enabled by default with Microsoft Defender Antivirus deployments.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
When Microsoft Defender Antivirus finds a suspicious file, it can prevent the file from running while it queries the [Microsoft Defender Antivirus cloud service](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can configure how users of the endpoints on your network can interact with Microsoft Defender Antivirus.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can exclude certain files, folders, processes, and process-opened files from Microsoft Defender Antivirus scans. Such exclusions apply to [scheduled scans](scheduled-catch-up-scans-microsoft-defender-antivirus.md), [on-demand scans](run-scan-microsoft-defender-antivirus.md), and [always-on real-time protection and monitoring](configure-real-time-protection-microsoft-defender-antivirus.md). Exclusions for process-opened files only apply to real-time protection.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response (EDR)](../microsoft-defender-atp/overview-endpoint-detection-response.md), [attack surface reduction (ASR) rules](../microsoft-defender-atp/attack-surface-reduction.md), and [controlled folder access](../microsoft-defender-atp/controlled-folders.md). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. To exclude files broadly, add them to the Microsoft Defender for Endpoint [custom indicators](../microsoft-defender-atp/manage-indicators.md).
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
By default, Microsoft Defender Antivirus settings that are deployed via a Group Policy Object to the endpoints in your network will prevent users from locally changing the settings. You can change this in some instances.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can configure Microsoft Defender Antivirus with a number of tools, including:
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
To ensure Microsoft Defender Antivirus cloud-delivered protection works properly, you need to configure your network to allow connections between your endpoints and certain Microsoft servers.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
In Windows 10, application notifications about malware detection and remediation are more robust, consistent, and concise.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can exclude files that have been opened by specific processes from Microsoft Defender Antivirus scans. See [Recommendations for defining exclusions](configure-exclusions-microsoft-defender-antivirus.md#recommendations-for-defining-exclusions) before defining your exclusion lists.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus uses several methods to provide threat protection:
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Always-on protection consists of real-time protection, behavior monitoring, and heuristics to identify malware based on known suspicious and malicious activities.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
When Microsoft Defender Antivirus runs a scan, it will attempt to remediate or remove threats that it finds. You can configure how Microsoft Defender Antivirus should react to certain threats, whether it should create a restore point before remediating, and when it should remove remediated threats.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 02/10/2021
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus on Windows Server 2016 and Windows Server 2019 automatically enrolls you in certain exclusions, as defined by your specified server role. See the [list of automatic exclusions](#list-of-automatic-exclusions) (in this article). These exclusions do not appear in the standard exclusion lists that are shown in the [Windows Security app](microsoft-defender-security-center-antivirus.md#exclusions).
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can use Group Policy, PowerShell, and Windows Management Instrumentation (WMI) to configure Microsoft Defender Antivirus scans.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can deploy, manage, and report on Microsoft Defender Antivirus in a number of ways.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Depending on the management tool you are using, you may need to specifically enable or configure Microsoft Defender Antivirus protection.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
In addition to standard on-premises or hardware configurations, you can also use Microsoft Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge)
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
> [!NOTE]
|
||||
> The Microsoft Defender Antivirus cloud service is a mechanism for delivering updated protection to your network and endpoints. Although it is called a cloud service, it is not simply protection for files stored in the cloud; rather, it uses distributed resources and machine learning to deliver protection to your endpoints at a rate that is far faster than traditional Security intelligence updates.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Use this guide to determine how well Microsoft Defender Antivirus protects you from viruses, malware, and potentially unwanted applications.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Limited periodic scanning is a special type of threat detection and remediation that can be enabled when you have installed another antivirus product on a Windows 10 device.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus allows you to determine if updates should (or should not) occur after certain events, such as at startup or after receiving specific reports from the cloud-delivered protection service.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus lets you define how long an endpoint can avoid an update or how many scans it can miss before it is required to update and scan itself. This is especially useful in environments where devices are not often connected to a corporate or external network, or devices that are not used on a daily basis.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus lets you determine when it should look for and download updates.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
There are two types of updates related to keeping Microsoft Defender Antivirus up to date:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Mobile devices and VMs may require more configuration to ensure performance is not impacted by updates.
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer: tewchen, pahuijbr, shwjha
|
||||
manager: dansimp
|
||||
ms.date: 02/09/2021
|
||||
ms.date: 02/24/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
## Overview
|
||||
|
||||
@ -56,12 +56,12 @@ The following table summarizes what happens with Microsoft Defender Antivirus wh
|
||||
|
||||
If you are using Windows Server, version 1803 or newer, or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: `ForceDefenderPassiveMode`
|
||||
- Name: `ForcePassiveMode`
|
||||
- Type: `REG_DWORD`
|
||||
- Value: `1`
|
||||
|
||||
> [!NOTE]
|
||||
> The `ForceDefenderPassiveMode` registry key is not supported on Windows Server 2016.
|
||||
> The `ForcePassiveMode` registry key is not supported on Windows Server 2016.
|
||||
|
||||
(<a id="fn2">2</a>) On Windows Server 2016, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In addition, Microsoft Defender Antivirus is not supported in passive mode. In those cases, [disable/uninstall Microsoft Defender Antivirus manually](microsoft-defender-antivirus-on-windows-server-2016.md#are-you-using-windows-server-2016) to prevent problems caused by having multiple antivirus products installed on a server.
|
||||
|
||||
@ -81,13 +81,13 @@ The table in this section summarizes the functionality and features that are ava
|
||||
> [!IMPORTANT]
|
||||
> Do not turn off capabilities, such as real-time protection, cloud-delivered protection, or limited periodic scanning, if you are using Microsoft Defender Antivirus in passive mode or you are using EDR in block mode.
|
||||
|
||||
|Protection |Active mode |Passive mode |EDR in block mode |Disabled or uninstalled |
|
||||
|:---|:---|:---|:---|:---|
|
||||
| [Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | Yes | No <sup>[[3](#fn3)]<sup> | No | No |
|
||||
| [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | No | No | No | Yes |
|
||||
| [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | Yes | Yes | Yes | No |
|
||||
| [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | Yes | See note <sup>[[4](#fn4)]<sup> | Yes | No |
|
||||
| [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | Yes | Yes | Yes | No |
|
||||
|Protection |Active mode |Passive mode |Disabled or uninstalled |
|
||||
|:---|:---|:---|:---|
|
||||
| [Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | Yes | No <sup>[[3](#fn3)]<sup> | No |
|
||||
| [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | No | No | Yes |
|
||||
| [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | Yes | Yes | No |
|
||||
| [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | Yes | See note <sup>[[4](#fn4)]<sup> | No |
|
||||
| [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | Yes | Yes | No |
|
||||
|
||||
(<a id="fn3">3</a>) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
## Microsoft Defender Antivirus: Your next-generation protection
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus is available on the following editions/versions of Windows Server:
|
||||
- Windows Server 2019
|
||||
@ -177,7 +177,7 @@ If you are using a non-Microsoft antivirus product as your primary antivirus sol
|
||||
|
||||
If you are using Windows Server, version 1803 or Windows Server 2019, you can set Microsoft Defender Antivirus to passive mode by setting the following registry key:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: `ForceDefenderPassiveMode`
|
||||
- Name: `ForcePassiveMode`
|
||||
- Type: `REG_DWORD`
|
||||
- Value: `1`
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR).
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
In Windows 10, version 1703 and later, the Windows Defender app is part of the Windows Security.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- Microsoft Defender Antivirus
|
||||
- Microsoft 365
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Tamper protection is available for devices that are running one of the following versions of Windows:
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can use Group Policy to prevent users on endpoints from seeing the Microsoft Defender Antivirus interface. You can also prevent them from pausing scans.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Antivirus is built into Windows 10, Windows Server 2019, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
If Microsoft Defender Antivirus is configured to detect and remediate threats on your device, Microsoft Defender Antivirus quarantines suspicious files. If you are certain a quarantined file is not a threat, you can restore it.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
After a Microsoft Defender Antivirus scan completes, whether it is an [on-demand](run-scan-microsoft-defender-antivirus.md) or [scheduled scan](scheduled-catch-up-scans-microsoft-defender-antivirus.md), the results are recorded and you can view the results.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can specify your level of cloud-delivered protection offered by Microsoft Defender Antivirus by using Microsoft Endpoint Manager (recommended) or Group Policy.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
|
||||
You can find help here if you encounter issues while migrating from a third-party security solution to Microsoft Defender Antivirus.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
If you encounter a problem with Microsoft Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On March 31, 2020, the Microsoft Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can use [Group Policy](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx) to configure and manage Microsoft Defender Antivirus on your endpoints.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
If you were using Microsoft Endpoint Manager or Microsoft Intune to manage the endpoints on your network, you can now use Microsoft Endpoint Manager to manage Microsoft Defender Antivirus scans.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
You can use PowerShell to perform various functions in Windows Defender. Similar to the command prompt or command line, PowerShell is a task-based command-line shell and scripting language designed especially for system administration. You can read more about it at the [PowerShell hub on MSDN](https://docs.microsoft.com/previous-versions/msdn10/mt173057(v=msdn.10)).
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Windows Management Instrumentation (WMI) is a scripting interface that allows you to retrieve, modify, and update settings.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft next-generation technologies in Microsoft Defender Antivirus provide near-instant, automated protection against new and emerging threats. To dynamically identify new threats, these technologies work with large sets of interconnected data in the Microsoft Intelligent Security Graph and powerful artificial intelligence (AI) systems driven by advanced machine learning models.
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.technology: mde
|
||||
# Configure Microsoft Defender Application Guard policy settings
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
Microsoft Defender Application Guard (Application Guard) works with Group Policy to help you manage your organization's computer settings. By using Group Policy, you can configure a setting once, and then copy it onto many computers. For example, you can set up multiple security settings in a GPO, which is linked to a domain, and then apply all those settings to every computer in the domain.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: FAQ - Microsoft Defender Application Guard (Windows 10)
|
||||
description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard.
|
||||
title: Microsoft Defender Application Guard FAQ (Windows 10)
|
||||
description: See frequently asked questions and answers for Microsoft Defender Application Guard.
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 01/21/2021
|
||||
ms.date: 03/01/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -19,11 +19,9 @@ ms.technology: mde
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Answering frequently asked questions about Microsoft Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration.
|
||||
This article lists frequently asked questions and answers about Microsoft Defender Application Guard (Application Guard) features, integration with the Windows operating system, and general configuration.
|
||||
|
||||
## Frequently Asked Questions
|
||||
|
||||
### Can I enable Application Guard on machines equipped with 4-GB RAM?
|
||||
## Can I enable Application Guard on machines equipped with 4-GB RAM?
|
||||
We recommend 8-GB RAM for optimal performance but you can use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration.
|
||||
|
||||
`HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount` (Default is four cores.)
|
||||
@ -32,29 +30,29 @@ We recommend 8-GB RAM for optimal performance but you can use the following regi
|
||||
|
||||
`HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB` (Default is 5 GB.)
|
||||
|
||||
### Can employees download documents from the Application Guard Edge session onto host devices?
|
||||
## Can employees download documents from the Application Guard Edge session onto host devices?
|
||||
|
||||
In Windows 10 Enterprise edition 1803, users are able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy.
|
||||
|
||||
In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device.
|
||||
In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host device. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device.
|
||||
|
||||
### Can employees copy and paste between the host device and the Application Guard Edge session?
|
||||
## Can employees copy and paste between the host device and the Application Guard Edge session?
|
||||
|
||||
Depending on your organization's settings, employees can copy and paste images (.bmp) and text to and from the isolated container.
|
||||
|
||||
### Why don't employees see their Favorites in the Application Guard Edge session?
|
||||
## Why don't employees see their Favorites in the Application Guard Edge session?
|
||||
|
||||
To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device.
|
||||
|
||||
### Why aren’t employees able to see their Extensions in the Application Guard Edge session?
|
||||
## Why aren’t employees able to see their extensions in the Application Guard Edge session?
|
||||
|
||||
Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this.
|
||||
Currently, the Application Guard Edge session doesn't support extensions. However, we're closely monitoring your feedback about this.
|
||||
|
||||
### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)?
|
||||
## How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)?
|
||||
|
||||
Microsoft Defender Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune.
|
||||
|
||||
### Which Input Method Editors (IME) in 19H1 are not supported?
|
||||
## Which Input Method Editors (IME) in 19H1 are not supported?
|
||||
|
||||
The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard.
|
||||
- Vietnam Telex keyboard
|
||||
@ -70,31 +68,31 @@ The following Input Method Editors (IME) introduced in Windows 10, version 1903
|
||||
- Odia phonetic keyboard
|
||||
- Punjabi phonetic keyboard
|
||||
|
||||
### I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering?
|
||||
## I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering?
|
||||
|
||||
This feature is currently experimental only and is not functional without an additional registry key provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature.
|
||||
|
||||
### What is the WDAGUtilityAccount local account?
|
||||
## What is the WDAGUtilityAccount local account?
|
||||
|
||||
This account is part of Application Guard beginning with Windows 10, version 1709 (Fall Creators Update). This account remains disabled until Application Guard is enabled on your device. This item is integrated to the OS and is not considered as a threat/virus/malware.
|
||||
|
||||
### How do I trust a subdomain in my site list?
|
||||
## How do I trust a subdomain in my site list?
|
||||
|
||||
To trust a subdomain, you must precede your domain with two dots, for example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted.
|
||||
To trust a subdomain, you must precede your domain with two dots. For example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted.
|
||||
|
||||
### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise?
|
||||
## Are there differences between using Application Guard on Windows Pro vs Windows Enterprise?
|
||||
|
||||
When using Windows Pro or Windows Enterprise, you have access to using Application Guard in Standalone Mode. However, when using Enterprise you have access to Application Guard in Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard).
|
||||
|
||||
### Is there a size limit to the domain lists that I need to configure?
|
||||
## Is there a size limit to the domain lists that I need to configure?
|
||||
|
||||
Yes, both the Enterprise Resource domains hosted in the cloud and the Domains categorized as both work and personal have a 16383-B limit.
|
||||
|
||||
### Why does my encryption driver break Microsoft Defender Application Guard?
|
||||
## Why does my encryption driver break Microsoft Defender Application Guard?
|
||||
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
|
||||
### Why do the Network Isolation policies in Group Policy and CSP look different?
|
||||
## Why do the Network Isolation policies in Group Policy and CSP look different?
|
||||
|
||||
There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy Application Guard are different between CSP and GP.
|
||||
|
||||
@ -104,64 +102,64 @@ For EnterpriseNetworkDomainNames, there is no mapped CSP policy.
|
||||
|
||||
Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (`0x80070013 ERROR_WRITE_PROTECT`).
|
||||
|
||||
### Why did Application Guard stop working after I turned off hyperthreading?
|
||||
## Why did Application Guard stop working after I turned off hyperthreading?
|
||||
|
||||
If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements.
|
||||
|
||||
### Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"?
|
||||
## Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"?
|
||||
|
||||
Application Guard might not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume.
|
||||
|
||||
### Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach PAC file?
|
||||
## Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach PAC file?
|
||||
|
||||
This is a known issue. To mitigate this you need to create two firewall rules.
|
||||
For guidance on how to create a firewall rule by using group policy, see:
|
||||
- [Create an inbound icmp rule](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/create-an-inbound-icmp-rule)
|
||||
- [Open Group Policy management console for Microsoft Defender Firewall](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security)
|
||||
|
||||
First rule (DHCP Server):
|
||||
### First rule (DHCP Server)
|
||||
|
||||
1. Program path: `%SystemRoot%\System32\svchost.exe`
|
||||
2. Local Service: `Sid: S-1-5-80-2009329905-444645132-2728249442-922493431-93864177 (Internet Connection Service (SharedAccess))`
|
||||
3. Protocol UDP
|
||||
4. Port 67
|
||||
|
||||
Second rule (DHCP Client)
|
||||
### Second rule (DHCP Client)
|
||||
|
||||
This is the same as the first rule, but scoped to local port 68.
|
||||
In the Microsoft Defender Firewall user interface go through the following steps:
|
||||
|
||||
In the Microsoft Defender Firewall user interface, take the following steps:
|
||||
1. Right click on inbound rules, create a new rule.
|
||||
2. Choose **custom rule**.
|
||||
3. Program path: `%SystemRoot%\System32\svchost.exe`.
|
||||
4. Protocol Type: UDP, Specific ports: 67, Remote port: any.
|
||||
4. Protocol Type: UDP, Specific ports: 68, Remote port: any.
|
||||
5. Any IP addresses.
|
||||
6. Allow the connection.
|
||||
7. All profiles.
|
||||
8. The new rule should show up in the user interface. Right click on the **rule** > **properties**.
|
||||
9. In the **Programs and services** tab, Under the **Services** section click on **settings**. Choose **Apply to this Service** and select **Internet Connection Sharing (ICS) Shared Access**.
|
||||
8. The new rule should show up in the user interface. Right-click on the rule, and then select **Properties**.
|
||||
9. In the **Programs and services** tab, under **Services**, select **settings**.
|
||||
10. Choose **Apply to this Service**, and then select **Internet Connection Sharing (ICS) Shared Access**.
|
||||
|
||||
### Why can I not launch Application Guard when Exploit Guard is enabled?
|
||||
## Why can I not launch Application Guard when Exploit Guard is enabled?
|
||||
|
||||
There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to **use default**.
|
||||
|
||||
|
||||
### How can I have ICS in enabled state yet still use Application Guard?
|
||||
## How can I have ICS in enabled state yet still use Application Guard?
|
||||
|
||||
ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We do not recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys.
|
||||
|
||||
1. In the Group Policy setting, **Prohibit use of Internet Connection Sharing on your DNS domain network**, set it to **Disabled**.
|
||||
|
||||
2. Disable IpNat.sys from ICS load as follows: <br/>
|
||||
`System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1`
|
||||
|
||||
3. Configure ICS (SharedAccess) to enabled as follows: <br/>
|
||||
`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3`
|
||||
|
||||
4. (This is optional) Disable IPNAT as follows: <br/>
|
||||
`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4`
|
||||
|
||||
5. Reboot the device.
|
||||
|
||||
### Why doesn't the container fully load when device control policies are enabled?
|
||||
Allow-listed items must be configured as "allowed" in the Group Policy Object ensure AppGuard works properly.
|
||||
## Why doesn't the container fully load when device control policies are enabled?
|
||||
|
||||
Allow-listed items must be configured as "allowed" in the Group Policy Object to ensure Application Guard works properly. This is a prerequisite. If the device installations have already been blocked by device control policies, the OS must be reinstalled to resolve this issue.
|
||||
|
||||
Policy: Allow installation of devices that match any of these device IDs
|
||||
- `SCSI\DiskMsft____Virtual_Disk____`
|
||||
@ -180,8 +178,6 @@ Policy: Allow installation of devices that match any of these device IDs
|
||||
Policy: Allow installation of devices using drivers that match these device setup classes
|
||||
- `{71a27cdd-812a-11d0-bec7-08002be2092f}`
|
||||
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
[Configure Microsoft Defender Application Guard policy settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard)
|
||||
|
||||
@ -18,7 +18,7 @@ ms.technology: mde
|
||||
# Prepare to install Microsoft Defender Application Guard
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
## Review system requirements
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
We've come up with a list of scenarios that you can use to test hardware-based isolation in your organization.
|
||||
|
||||
|
||||
@ -13,7 +13,7 @@ ms.topic: article
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.custom: nextgen
|
||||
ms.date: 02/18/2021
|
||||
ms.date: 02/24/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.technology: mde
|
||||
@ -23,8 +23,6 @@ ms.technology: mde
|
||||
|
||||
Applies to:
|
||||
- Windows 10 multi-session running on Windows Virtual Desktop (WVD)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
@ -33,7 +31,7 @@ Applies to:
|
||||
|
||||
Microsoft Defender for Endpoint supports monitoring both VDI as well as Windows Virtual Desktop sessions. Depending on your organization's needs, you might need to implement VDI or Windows Virtual Desktop sessions to help your employees access corporate data and apps from an unmanaged device, remote location, or similar scenario. With Microsoft Defender for Endpoint, you can monitor these virtual machines for anomalous activity.
|
||||
|
||||
## Before you begin
|
||||
## Before you begin
|
||||
|
||||
See [considerations for non-persistent VDI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi#onboard-non-persistent-virtual-desktop-infrastructure-vdi-devices-1). Although [Windows Virtual Desktop](https://docs.microsoft.com/azure/virtual-desktop/overview) does not provide non-persistence options, it does provide ways to use a Windows image that can be used to provision new hosts and redeploy machines. This increases volatility in the environment, and thus impacts what entries are created and maintained in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)), potentially reducing visibility for your security analysts.
|
||||
|
||||
|
||||
@ -21,15 +21,15 @@ ms.technology: mde
|
||||
# Access the Microsoft Defender Security Center MSSP customer portal
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Add or Remove Machine Tags API
|
||||
description: Learn how to use the Add or Remove machine tags API to adds or remove a tag for a machine in Microsoft Defender Advanced Threat Protection.
|
||||
description: Learn how to use the Add or Remove machine tags API to adds or remove a tag for a machine in Microsoft Defender for Endpoint.
|
||||
keywords: apis, graph api, supported apis, tags, machine tags
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: m365-security
|
||||
@ -20,8 +20,8 @@ ms.technology: mde
|
||||
# Add or Remove Machine Tags API
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure advanced features in Microsoft Defender ATP
|
||||
description: Turn on advanced features such as block file in Microsoft Defender Advanced Threat Protection.
|
||||
keywords: advanced features, settings, block file, automated investigation, auto-resolve, skype, azure atp, office 365, azure information protection, intune
|
||||
title: Configure advanced features in Microsoft Defender for Endpoint
|
||||
description: Turn on advanced features such as block file in Microsoft Defender for Endpoint.
|
||||
keywords: advanced features, settings, block file, automated investigation, auto-resolve, skype, microsoft defender for identity, office 365, azure information protection, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
@ -21,13 +21,13 @@ ms.technology: mde
|
||||
# Configure advanced features in Defender for Endpoint
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Defender for Endpoint with.
|
||||
|
||||
@ -61,15 +61,15 @@ Enabling this feature allows you to run unsigned scripts in a live response sess
|
||||
|
||||
## Autoresolve remediated alerts
|
||||
|
||||
For tenants created on or after Windows 10, version 1809 the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don't want to have alerts auto-resolved, you'll need to manually turn off the feature.
|
||||
For tenants created on or after Windows 10, version 1809, the automated investigation and remediation capability is configured by default to resolve alerts where the automated analysis result status is "No threats found" or "Remediated". If you don't want to have alerts auto-resolved, you'll need to manually turn off the feature.
|
||||
|
||||
>[!TIP]
|
||||
>For tenants created prior that version, you'll need to manually turn this feature on from the [Advanced features](https://securitycenter.windows.com/preferences2/integration) page.
|
||||
> [!TIP]
|
||||
> For tenants created prior to that version, you'll need to manually turn this feature on from the [Advanced features](https://securitycenter.windows.com/preferences2/integration) page.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
>
|
||||
>- The result of the auto-resolve action may influence the Device risk level calculation which is based on the active alerts found on a device.
|
||||
>- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it.
|
||||
> - The result of the auto-resolve action may influence the Device risk level calculation which is based on the active alerts found on a device.
|
||||
> - If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it.
|
||||
|
||||
## Allow or block file
|
||||
|
||||
@ -100,8 +100,8 @@ To use this feature, devices must be running Windows 10 version 1709 or later. T
|
||||
|
||||
For more information, see [Manage indicators](manage-indicators.md).
|
||||
|
||||
>[!NOTE]
|
||||
>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Defender for Endpoint data.
|
||||
> [!NOTE]
|
||||
> Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Defender for Endpoint data.
|
||||
|
||||
## Show user details
|
||||
|
||||
@ -117,15 +117,15 @@ For more information, see [Investigate a user account](investigate-user.md).
|
||||
|
||||
Enabling the Skype for Business integration gives you the ability to communicate with users using Skype for Business, email, or phone. This can be handy when you need to communicate with the user and mitigate risks.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> When a device is being isolated from the network, there's a pop-up where you can choose to enable Outlook and Skype communications which allows communications to the user while they are disconnected from the network. This setting applies to Skype and Outlook communication when devices are in isolation mode.
|
||||
|
||||
## Azure Advanced Threat Protection integration
|
||||
|
||||
The integration with Azure Advanced Threat Protection allows you to pivot directly into another Microsoft Identity security product. Azure Advanced Threat Protection augments an investigation with additional insights about a suspected compromised account and related resources. By enabling this feature, you'll enrich the device-based investigation capability by pivoting across the network from an identify point of view.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
> [!NOTE]
|
||||
> You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
## Office 365 Threat Intelligence connection
|
||||
|
||||
@ -133,24 +133,24 @@ This feature is only available if you have an active Office 365 E5 or the Threat
|
||||
|
||||
When you turn this feature on, you'll be able to incorporate data from Office 365 Advanced Threat Protection into Microsoft Defender Security Center to conduct a comprehensive security investigation across Office 365 mailboxes and Windows devices.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
> [!NOTE]
|
||||
> You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
To receive contextual device integration in Office 365 Threat Intelligence, you'll need to enable the Defender for Endpoint settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
|
||||
To receive contextual device integration in Office 365 Threat Intelligence, you'll need to enable the Defender for Endpoint settings in the Security & Compliance dashboard. For more information, see [Threat investigation and response](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-ti).
|
||||
|
||||
## Microsoft Threat Experts
|
||||
|
||||
Out of the two Microsoft Threat Expert components, targeted attack notification is in general availability. Experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. You can receive targeted attack notifications from Microsoft Threat Experts through your Defender for Endpoint portal's alerts dashboard and via email if you configure it.
|
||||
|
||||
>[!NOTE]
|
||||
>The Microsoft Threat Experts capability in Defender for Endpoint is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security).
|
||||
> [!NOTE]
|
||||
> The Microsoft Threat Experts capability in Defender for Endpoint is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security).
|
||||
|
||||
## Microsoft Cloud App Security
|
||||
|
||||
Enabling this setting forwards Defender for Endpoint signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
|
||||
|
||||
>[!NOTE]
|
||||
>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on devices running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)) or later Windows 10 versions.
|
||||
> [!NOTE]
|
||||
> This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on devices running Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441)), Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464)), Windows 10, version 1809 (OS Build 17763.379 with [KB4489899](https://support.microsoft.com/help/4489899)), or later Windows 10 versions.
|
||||
|
||||
## Azure Information Protection
|
||||
|
||||
@ -158,13 +158,13 @@ Turning on this setting allows signals to be forwarded to Azure Information Prot
|
||||
|
||||
## Microsoft Secure Score
|
||||
|
||||
Forwards Microsoft Defender ATP signals to Microsoft Secure Score in the Microsoft 365 security center. Turning on this feature gives Microsoft Secure Score visibility into the devices security posture. Forwarded data is stored and processed in the same location as the your Microsoft Secure Score data.
|
||||
Forwards Microsoft Defender for Endpoint signals to Microsoft Secure Score in the Microsoft 365 security center. Turning on this feature gives Microsoft Secure Score visibility into the device's security posture. Forwarded data is stored and processed in the same location as your Microsoft Secure Score data.
|
||||
|
||||
### Enable the Microsoft Defender ATP integration from the Azure ATP portal
|
||||
### Enable the Microsoft Defender for Endpoint integration from the Microsoft Defender for Identity portal
|
||||
|
||||
To receive contextual device integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
|
||||
To receive contextual device integration in Microsoft Defender for Identity, you'll also need to enable the feature in the Microsoft Defender for Identity portal.
|
||||
|
||||
1. Log in to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
1. Log in to the [Microsoft Defender for Identity portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
|
||||
2. Click **Create your instance**.
|
||||
|
||||
@ -176,8 +176,8 @@ After completing the integration steps on both portals, you'll be able to see re
|
||||
|
||||
Defender for Endpoint can be integrated with [Microsoft Intune](https://docs.microsoft.com/intune/what-is-intune) to [enable device risk-based conditional access](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). When you [turn on this feature](configure-conditional-access.md), you'll be able to share Defender for Endpoint device information with Intune, enhancing policy enforcement.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You'll need to enable the integration on both Intune and Defender for Endpoint to use this feature. For more information on specific steps, see [Configure Conditional Access in Defender for Endpoint](configure-conditional-access.md).
|
||||
> [!IMPORTANT]
|
||||
> You'll need to enable the integration on both Intune and Defender for Endpoint to use this feature. For more information on specific steps, see [Configure Conditional Access in Defender for Endpoint](configure-conditional-access.md).
|
||||
|
||||
This feature is only available if you have the following:
|
||||
|
||||
@ -188,7 +188,7 @@ This feature is only available if you have the following:
|
||||
|
||||
When you enable Intune integration, Intune will automatically create a classic Conditional Access (CA) policy. This classic CA policy is a prerequisite for setting up status reports to Intune. It should not be deleted.
|
||||
|
||||
>[!NOTE]
|
||||
> [!NOTE]
|
||||
> The classic CA policy created by Intune is distinct from modern [Conditional Access policies](https://docs.microsoft.com/azure/active-directory/conditional-access/overview/), which are used for configuring endpoints.
|
||||
|
||||
## Preview features
|
||||
@ -207,4 +207,3 @@ After configuring the [Security policy violation indicators](https://docs.micros
|
||||
|
||||
- [Update data retention settings](data-retention-settings.md)
|
||||
- [Configure alert notifications](configure-email-notifications.md)
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: AssignedIPAddresses() function in advanced hunting for Microsoft Defender Advanced Threat Protection
|
||||
title: AssignedIPAddresses() function in advanced hunting for Microsoft Defender for Endpoint
|
||||
description: Learn how to use the AssignedIPAddresses() function to get the latest IP addresses assigned to a device
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, Microsoft Defender ATP, Microsoft Defender Advanced Threat Protection, Windows Defender, Windows Defender ATP, Windows Defender Advanced Threat Protection, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, Microsoft Defender ATP, Microsoft Defender for Endpoint, Windows Defender, Windows Defender ATP, Windows Defender Advanced Threat Protection, search, query, telemetry, schema reference, kusto, FileProfile, file profile, function, enrichment
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
@ -26,8 +26,8 @@ ms.technology: mde
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
Use the `AssignedIPAddresses()` function in your advanced hunting queries to quickly obtain the latest IP addresses that have been assigned to a device. If you specify a timestamp argument, this function obtains the most recent IP addresses at the specified time.
|
||||
|
||||
|
||||
@ -23,8 +23,8 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,8 +24,8 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
@ -23,8 +23,8 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/p/?linkid=2118804)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user