From 6186a92adaf5d90667a5a0c4d99808e9816d2a34 Mon Sep 17 00:00:00 2001 From: Ryan Hecht <78107732+RyanHechtMSFT@users.noreply.github.com> Date: Mon, 14 Feb 2022 12:02:26 -0500 Subject: [PATCH 01/10] Add additional Microsoft Edge endpoint --- ...erating-system-components-to-microsoft-services-using-MDM.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index be4a1f0663..f12658e2d0 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -179,4 +179,4 @@ For Windows 10 and Windows 11, the following MDM policies are available in the [ |settings-win.data.microsoft.com| |msedge.api.cdp.microsoft.com| |\*.dl.delivery.mp.microsoft.com| - +|edge.microsoft.com| From 832a449ad83ca2e6fde4a4368b9ced6c7b4f2e1b Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 15 Feb 2022 16:30:35 -0800 Subject: [PATCH 02/10] Updated the recommended driver blocklist with the latest vulnerable driver additions --- ...icrosoft-recommended-driver-block-rules.md | 399 +++++++++++++++--- 1 file changed, 331 insertions(+), 68 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index cf94595896..e4cc6d0f33 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -46,7 +46,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- ```xml - 10.0.22493.0 + 10.0.22530.0 {D2BDA982-CCF6-4344-AC5B-0B44427B6816} {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -64,6 +64,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + @@ -112,6 +114,14 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + @@ -145,7 +155,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -157,10 +167,60 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -169,6 +229,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -328,66 +392,114 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + - - + + + + + + + + + + + + + + - + + + + + - + + + + + - + + + + - + - + + + + + + + + + + + + + + + @@ -407,33 +519,44 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + - - + + + - - + + + + + + + + + + + @@ -443,18 +566,27 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + + - - - - - - + + + + + + + + + + + + + + @@ -466,6 +598,13 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + @@ -479,8 +618,14 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + @@ -499,6 +644,42 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -526,42 +707,59 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - - - - - + + + + - - + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - + @@ -610,6 +808,14 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + @@ -643,7 +849,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -655,10 +861,60 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -667,6 +923,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -831,6 +1091,9 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + @@ -845,7 +1108,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - 10.0.22493.0 + 10.0.22530.0 From 4a2b22a6811ec7671d3a669d928aad27491a93cf Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 15 Feb 2022 16:32:13 -0800 Subject: [PATCH 03/10] Removed the ALLOW ALL rules --- .../microsoft-recommended-driver-block-rules.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index e4cc6d0f33..f486f73efc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -64,8 +64,6 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - From 57fa8b44c6489650a758f9b5726bf584255da9fb Mon Sep 17 00:00:00 2001 From: Ying Hua Date: Wed, 16 Feb 2022 13:40:34 +0800 Subject: [PATCH 04/10] update with existing .openpublishing.publish.config.json --- .openpublishing.publish.config.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index f9ebdac192..389a789ca5 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -405,13 +405,13 @@ { "path_to_root": "_themes.pdf", "url": "https://github.com/Microsoft/templates.docs.msft.pdf", - "branch": "master", + "branch": "main", "branch_mapping": {} }, { "path_to_root": "_themes", "url": "https://github.com/Microsoft/templates.docs.msft", - "branch": "master", + "branch": "main", "branch_mapping": {} } ], @@ -420,7 +420,7 @@ "Publish", "Pdf" ], - "master": [ + "main": [ "Publish", "Pdf" ] From 418df1ff4dd6626605b8e0f9bc9ab68a823fc22a Mon Sep 17 00:00:00 2001 From: Thomas Raya Date: Wed, 16 Feb 2022 14:18:54 -0800 Subject: [PATCH 05/10] Update .acrolinx-config.edn --- .acrolinx-config.edn | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn index 64354d7a64..9f8eac523b 100644 --- a/.acrolinx-config.edn +++ b/.acrolinx-config.edn @@ -1,4 +1,4 @@ -{:allowed-branchname-matches ["master" "main"] +{:allowed-branchname-matches ["main"] :allowed-filename-matches ["windows/"] :targets From ed28ece5ac701fe7356e980948ddaf28cf40f6f1 Mon Sep 17 00:00:00 2001 From: Michael Mardahl Date: Fri, 18 Feb 2022 09:41:20 +0100 Subject: [PATCH 06/10] Update hello-faq.yml Updated the information around Cloud Trust, since there is now supported documentation on this. --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 66e88ee1a6..6919aa730d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -28,7 +28,7 @@ sections: questions: - question: What is Windows Hello for Business cloud trust? answer: | - Windows Hello for Business cloud trust is a new trust model that is planned to be introduced in early 2022. This trust model will enable Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). More information will be available on Windows Hello for Business cloud trust once it is generally available. + Windows Hello for Business cloud trust is a new trust model that is currently in preview. This trust model will enable Windows Hello for Business deployment using the infrastructure introduced for supporting [security key sign-in on Hybrid Azure AD joined devices and on-premises resource access on Azure AD Joined devices](/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). Cloud trust is the preferred deployment model if you do not need to support certificate authentication scenarios. For more information, see [Hybrid Cloud Trust Deployment (Preview)](/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust). - question: What about virtual smart cards? answer: | From c2a221deea10a600d5387a5c0a567c3c57074eb6 Mon Sep 17 00:00:00 2001 From: Peter Smith Date: Fri, 18 Feb 2022 17:21:35 -0800 Subject: [PATCH 07/10] Reduce the number of times Lockdown is mentioned in the documentation Per recommendation, we are moving away from recommending LockDown; it's not appropriate for many customers. --- windows/security/identity-protection/vpn/vpn-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index f1ef2a83ef..6f798fede1 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -37,7 +37,7 @@ To create a Windows 10 VPN device configuration profile see: [Windows 10 and Win | [VPN and conditional access](vpn-conditional-access.md) | Use Azure Active Directory policy evaluation to set access policies for VPN connections. | | [VPN name resolution](vpn-name-resolution.md) | Decide how name resolution should work | | [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) | Set a VPN profile to connect automatically by app or by name, to be "always on", and to not trigger VPN on trusted networks | -| [VPN security features](vpn-security-features.md) | Set a LockDown VPN profile, configure traffic filtering, and connect VPN profile to Windows Information Protection (WIP) | +| [VPN security features](vpn-security-features.md) | Configure traffic filtering, connect a VPN profile to Windows Information Protection (WIP), and more | | [VPN profile options](vpn-profile-options.md) | Combine settings into single VPN profile using XML | From 1573feac9019692345a453e2b51dcb6464767347 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 21 Feb 2022 15:43:28 -0800 Subject: [PATCH 08/10] Update hello-faq.yml --- .../identity-protection/hello-for-business/hello-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 6919aa730d..88951c747a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -16,7 +16,7 @@ metadata: - highpri ms.topic: article localizationpriority: medium - ms.date: 10/15/2021 + ms.date: 02/21/2022 title: Windows Hello for Business Frequently Asked Questions (FAQ) summary: | From a3edbdccceb3e3fa114e8d661555f91475dd9442 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 21 Feb 2022 15:46:07 -0800 Subject: [PATCH 09/10] Update vpn-guide.md --- windows/security/identity-protection/vpn/vpn-guide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index 6f798fede1..58f9b162de 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: dansimp ms.localizationpriority: medium -ms.date: 09/09/2021 +ms.date: 02/21/2022 ms.reviewer: manager: dansimp ms.author: dansimp @@ -29,7 +29,7 @@ To create a Windows 10 VPN device configuration profile see: [Windows 10 and Win ## In this guide -| Topic | Description | +| Article | Description | | --- | --- | | [VPN connection types](vpn-connection-type.md) | Select a VPN client and tunneling protocol | | [VPN routing decisions](vpn-routing.md) | Choose between split tunnel and force tunnel configuration | From fb6861aec969661f05930e79c2489999f5f1443e Mon Sep 17 00:00:00 2001 From: Dan Pandre <54847950+DanPandre@users.noreply.github.com> Date: Tue, 22 Feb 2022 11:20:06 -0500 Subject: [PATCH 10/10] Fixing typo in PasswordRotationEnabled --- windows/client-management/mdm/surfacehub-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index e0a043830c..1bf5a8b231 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -31,7 +31,7 @@ SurfaceHub --------Email --------CalendarSyncEnabled --------ErrorContext ---------PasswordRotationPeriod +--------PasswordRotationEnabled ----MaintenanceHoursSimple --------Hours ------------StartTime