From 6fd5a0187152f2ed624d3e464c00cd5effcc8857 Mon Sep 17 00:00:00 2001 From: MSFTandrelom <54631941+MSFTandrelom@users.noreply.github.com> Date: Wed, 11 Sep 2019 14:01:44 +0300 Subject: [PATCH 001/335] Update credential-guard-manage.md Customer pointed out that while they were following steps outlined in the article, they ran into some errors. Validation revealed that step 3 in the feature installation procedure is outdated as of Windows 10 1607. Added a note about that --- .../credential-guard/credential-guard-manage.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index b8b2673d47..f1ac04eb7a 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -86,6 +86,8 @@ You can do this by using either the Control Panel or the Deployment Image Servic ``` dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` +> [!NOTE] +> In Windows 10 1607 or later versions, Isolated User Mode feature has been integrated into the core Operating system, so running the above command step 3 is no longer necessary > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. From 47670360a1d604cf8b6ad8bc223af22bd7941b02 Mon Sep 17 00:00:00 2001 From: MSFTandrelom <54631941+MSFTandrelom@users.noreply.github.com> Date: Thu, 12 Sep 2019 09:31:46 +0300 Subject: [PATCH 002/335] Update windows/security/identity-protection/credential-guard/credential-guard-manage.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../credential-guard/credential-guard-manage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index f1ac04eb7a..20e0057677 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -87,7 +87,7 @@ You can do this by using either the Control Panel or the Deployment Image Servic dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` > [!NOTE] -> In Windows 10 1607 or later versions, Isolated User Mode feature has been integrated into the core Operating system, so running the above command step 3 is no longer necessary +> In Windows 10 1607 and later versions, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. From e796b37f5601f860a5cbd2661430d22ad6949ad2 Mon Sep 17 00:00:00 2001 From: MSFTandrelom <54631941+MSFTandrelom@users.noreply.github.com> Date: Sat, 14 Sep 2019 09:44:52 +0300 Subject: [PATCH 003/335] Update windows/security/identity-protection/credential-guard/credential-guard-manage.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../credential-guard/credential-guard-manage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 20e0057677..239a1d56a5 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -87,7 +87,7 @@ You can do this by using either the Control Panel or the Deployment Image Servic dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` > [!NOTE] -> In Windows 10 1607 and later versions, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. +> In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. From 21ab42a4a2332c7227ccf7f05de6b61d7ccffe40 Mon Sep 17 00:00:00 2001 From: Chris De Neve <12743240+chrisdeneve@users.noreply.github.com> Date: Sun, 8 Dec 2019 15:16:48 +0100 Subject: [PATCH 004/335] Update Connect-AutopilotIntune to Connect-MSGraph Connect-AutopilotIntune doesn't exist anymore - instead, Connect-MSGraph should be used --- windows/deployment/windows-autopilot/existing-devices.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md index e762a53ed9..0f51078ae4 100644 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ b/windows/deployment/windows-autopilot/existing-devices.md @@ -71,12 +71,12 @@ See the following examples. ``` 3. Enter the following lines and provide Intune administrative credentials - - In the following command, replace the example user principal name for Azure authentication (admin@M365x373186.onmicrosoft.com) with your user account. Be sure that the user account you specify has sufficient administrative rights. + - Be sure that the user account you specify has sufficient administrative rights. ```powershell - Connect-AutopilotIntune -user admin@M365x373186.onmicrosoft.com + Connect-MSGraph ``` - The password for your account will be requested using a standard Azure AD form. Type your password and then click **Sign in**. + The user and password for your account will be requested using a standard Azure AD form. Type your username and password and then click **Sign in**.
See the following example: ![Azure AD authentication](images/pwd.png) From ca2babbc5adf278769cba2c76e06c7532304667c Mon Sep 17 00:00:00 2001 From: Chris De Neve <12743240+chrisdeneve@users.noreply.github.com> Date: Wed, 11 Dec 2019 11:50:22 +0100 Subject: [PATCH 005/335] Update - Install powershell module for MS.Graph.Intune --- windows/deployment/windows-autopilot/existing-devices.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md index 0f51078ae4..fbe94ff0da 100644 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ b/windows/deployment/windows-autopilot/existing-devices.md @@ -68,6 +68,7 @@ See the following examples. Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force Install-Module AzureAD -Force Install-Module WindowsAutopilotIntune -Force + Install-Module Microsoft.Graph.Intune -Force ``` 3. Enter the following lines and provide Intune administrative credentials From 2d0f31588b32b2e75ede7e4465e79b4ba4559124 Mon Sep 17 00:00:00 2001 From: NagaCSC Date: Thu, 12 Dec 2019 16:52:44 -0800 Subject: [PATCH 006/335] Delat CRL note add note for Delta CRL --- .../hello-for-business/hello-hybrid-aadj-sso-base.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 060bf7e60a..8ed1157475 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -58,6 +58,8 @@ To resolve this issue, the CRL distribution point must be a location that is acc If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points. +Note: If your CA has both Base and Delta CRL published. please make sure. you have included publishing the delta CRL in the http path. Include web server to fetch delta crl by allowing doubleescaping in the (IIS) web server. + ### Windows Server 2016 Domain Controllers If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -151,6 +153,7 @@ These procedures configure NTFS and share permissions on the web server to allow ![CDP Share Permissions](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. + #### Disable Caching 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. From 5e900d9706bde6e25e0c431f080a4fa16b87622e Mon Sep 17 00:00:00 2001 From: NagaCSC Date: Fri, 13 Dec 2019 09:26:58 -0800 Subject: [PATCH 007/335] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md Looks good, commit the changes Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-base.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 8ed1157475..37e65c43d4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -58,7 +58,7 @@ To resolve this issue, the CRL distribution point must be a location that is acc If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points. -Note: If your CA has both Base and Delta CRL published. please make sure. you have included publishing the delta CRL in the http path. Include web server to fetch delta crl by allowing doubleescaping in the (IIS) web server. +Note: If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. ### Windows Server 2016 Domain Controllers If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -340,4 +340,3 @@ If you plan on using certificates for on-premises single-sign on, perform the ad - From 51d426f01769008c1aba0432e89b8113a6f7a0a6 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 16:34:14 -0800 Subject: [PATCH 008/335] AH Schema naming --- .../advanced-hunting-alertevents-table.md | 8 ++++---- .../advanced-hunting-best-practices.md | 18 ++++++++--------- ...=> advanced-hunting-deviceevents-table.md} | 18 ++++++++--------- ...dvanced-hunting-devicefileevents-table.md} | 18 ++++++++--------- ...ed-hunting-deviceimageloadevents-table.md} | 18 ++++++++--------- ...d => advanced-hunting-deviceinfo-table.md} | 20 +++++++++---------- ...vanced-hunting-devicelogonevents-table.md} | 20 +++++++++---------- ...nced-hunting-devicenetworkevents-table.md} | 18 ++++++++--------- ...vanced-hunting-devicenetworkinfo-table.md} | 18 ++++++++--------- ...nced-hunting-deviceprocessevents-table.md} | 18 ++++++++--------- ...ced-hunting-deviceregistryevents-table.md} | 18 ++++++++--------- .../advanced-hunting-query-language.md | 18 ++++++++--------- .../advanced-hunting-schema-reference.md | 18 ++++++++--------- ...nced-hunting-tvm-configassessment-table.md | 4 ++-- ...ced-hunting-tvm-softwareinventory-table.md | 4 ++-- .../microsoft-defender-atp/api-power-bi.md | 2 +- .../attack-surface-reduction.md | 2 +- .../controlled-folders.md | 2 +- .../custom-detection-rules.md | 14 ++++++------- .../exploit-protection.md | 2 +- .../exposed-apis-full-sample-powershell.md | 2 +- .../information-protection-investigation.md | 2 +- .../investigate-behind-proxy.md | 6 +++--- .../network-protection.md | 2 +- .../microsoft-defender-atp/preview.md | 2 +- .../run-advanced-query-api.md | 2 +- .../run-advanced-query-sample-powershell.md | 2 +- .../run-advanced-query-sample-python.md | 2 +- .../threat-and-vuln-mgt-scenarios.md | 8 ++++---- 29 files changed, 143 insertions(+), 143 deletions(-) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-miscevents-table.md => advanced-hunting-deviceevents-table.md} (84%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-filecreationevents-table.md => advanced-hunting-devicefileevents-table.md} (86%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-imageloadevents-table.md => advanced-hunting-deviceimageloadevents-table.md} (83%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-machineinfo-table.md => advanced-hunting-deviceinfo-table.md} (75%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-logonevents-table.md => advanced-hunting-devicelogonevents-table.md} (82%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-networkcommunicationevents-table.md => advanced-hunting-devicenetworkevents-table.md} (83%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-machinenetworkinfo-table.md => advanced-hunting-devicenetworkinfo-table.md} (77%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-processcreationevents-table.md => advanced-hunting-deviceprocessevents-table.md} (88%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-registryevents-table.md => advanced-hunting-deviceregistryevents-table.md} (85%) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index 84eb799e45..b5e080a33e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -33,9 +33,9 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| | AlertId | string | Unique identifier for the alert | -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | | Category | string | Type of threat indicator or breach activity identified by the alert | | Title | string | Title of the alert | @@ -43,7 +43,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | SHA1 | string | SHA-1 of the file that the recorded action was applied to | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | | RemoteIP | string | IP address that was being connected to | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | Table | string | Table that contains the details of the event | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index bb1e594c49..deb89add9d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -41,14 +41,14 @@ Apply these recommendations to get results faster and avoid timeouts while runni ## Query tips and pitfalls ### Queries with process IDs -Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `MachineId` or `ComputerName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). +Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `DeviceId` or `DeviceName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). The following example query finds processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares. ``` -NetworkCommunicationEvents -| where RemotePort == 445 and EventTime > ago(12h) and InitiatingProcessId !in (0, 4) -| summarize RemoteIPCount=dcount(RemoteIP) by ComputerName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName +DeviceNetworkEvents +| where RemotePort == 445 and Timestamp > ago(12h) and InitiatingProcessId !in (0, 4) +| summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName | where RemoteIPCount > 10 ``` @@ -70,17 +70,17 @@ The following examples show various ways to construct a query that looks for the ``` // Non-durable query - do not use -ProcessCreationEvents +DeviceProcessEvents | where ProcessCommandLine == "net stop MpsSvc" | limit 10 // Better query - filters on filename, does case-insensitive matches -ProcessCreationEvents -| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc" +DeviceProcessEvents +| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc" // Best query also ignores quotes -ProcessCreationEvents -| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") +DeviceProcessEvents +| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe") | extend CanonicalCommandLine=replace("\"", "", ProcessCommandLine) | where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc" ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md similarity index 84% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 2e6c3ad70f..1acdf557bf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,6 +1,6 @@ --- -title: MiscEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous events (MiscEvents) table of the Advanced hunting schema +title: DeviceEvents table in the advanced hunting schema +description: Learn about antivirus, firewall, and other event types in the miscellaneous events (DeviceEvents) table of the Advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MiscEvents +# DeviceEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous events or MiscEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -45,7 +45,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AccountName |string | User name of the account | | AccountSid | string | Security Identifier (SID) of the account | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | | ProcessId | int | Process ID (PID) of the newly created process | | ProcessCommandLine | string | Command line used to create the new process | | ProcessCreationTime | datetime | Date and time the process was created | @@ -76,7 +76,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | | InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | | InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md similarity index 86% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 957282b72c..08c61045ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -1,7 +1,7 @@ --- -title: FileCreationEvents table in the Advanced hunting schema -description: Learn about file-related events in the FileCreationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, filecreationevents, files, path, hash, sha1, sha256, md5 +title: DeviceFileEvents table in the Advanced hunting schema +description: Learn about file-related events in the DeviceFileEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5 search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# FileCreationEvents +# DeviceFileEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The FileCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The DeviceFileEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -66,7 +66,7 @@ For information on other tables in the Advanced hunting schema, see [the Advanc | RequestAccountName | string | User name of account used to remotely initiate the activity | | RequestAccountDomain | string | Domain of the account used to remotely initiate the activity | | RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | | SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md similarity index 83% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index 68ceff1055..ebfd8dd80a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -1,7 +1,7 @@ --- -title: ImageLoadEvents table in the Advanced hunting schema -description: Learn about DLL loading events in the ImageLoadEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, imageloadevents, DLL loading, library, file image +title: DeviceImageLoadEvents table in the Advanced hunting schema +description: Learn about DLL loading events in the DeviceImageLoadEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# ImageLoadEvents +# DeviceImageLoadEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The DeviceImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -55,7 +55,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md similarity index 75% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index a986602549..7d8fb7823b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -1,7 +1,7 @@ --- -title: MachineInfo table in the Advanced hunting schema -description: Learn about OS, computer name, and other machine information in the MachineInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machineinfo, device, machine, OS, platform, users +title: DeviceInfo table in the Advanced hunting schema +description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MachineInfo +# DeviceInfo **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The DeviceInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ClientVersion | string | Version of the endpoint agent or sensor running on the machine | | PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | | OSArchitecture | string | Architecture of the operating system running on the machine | @@ -42,8 +42,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | OSBuild | string | Build version of the operating system running on the machine | | IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | | LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| RegistryMachineTag | string | Machine tag added through the registry | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| RegistryDeviceTag | string | Machine tag added through the registry | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | OSVersion | string | Version of the operating system running on the machine | | MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md similarity index 82% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index eb6044fda7..196bdde977 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -1,7 +1,7 @@ --- -title: LogonEvents table in the Advanced hunting schema -description: Learn about authentication or sign-in events in the LogonEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, logonevents, authentication, logon, sign in +title: DeviceLogonEvents table in the Advanced hunting schema +description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# LogonEvents +# DeviceLogonEvents **Applies to:** @@ -26,22 +26,22 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The LogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The DeviceLogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string |Type of activity that triggered the event | | AccountDomain | string | Domain of the account | | AccountName | string | User name of the account | | AccountSid | string | Security Identifier (SID) of the account | | LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| | LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | | RemoteIP | string | IP address that was being connected to | | RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | | RemotePort | int | TCP port on the remote device that was being connected to | @@ -62,7 +62,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md similarity index 83% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 5485d2b86e..581b173d15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -1,7 +1,7 @@ --- -title: NetworkCommunicationEvents table in the Advanced hunting schema -description: Learn about network connection events you can query from the NetworkCommunicationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, networkcommunicationevents, network connection, remote ip, local ip +title: DeviceNetworkEvents table in the Advanced hunting schema +description: Learn about network connection events you can query from the DeviceNetworkEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# NetworkCommunicationEvents +# DeviceNetworkEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The NetworkCommunicationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The DeviceNetworkEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | RemoteIP | string | IP address that was being connected to | | RemotePort | int | TCP port on the remote device that was being connected to | @@ -59,7 +59,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | | InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md similarity index 77% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index a09d2619f2..66f0663d23 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -1,7 +1,7 @@ --- -title: MachineNetworkInfo table in the Advanced hunting schema -description: Learn about network configuration information in the MachineNetworkInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machinenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel +title: DeviceNetworkInfo table in the Advanced hunting schema +description: Learn about network configuration information in the DeviceNetworkInfo table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MachineNetworkInfo +# DeviceNetworkInfo **Applies to:** @@ -26,16 +26,16 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The DeviceNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | NetworkAdapterName | string | Name of the network adapter | | MacAddress | string | MAC address of the network adapter | | NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md similarity index 88% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 43746ac557..42ed9a3829 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -1,7 +1,7 @@ --- -title: ProcessCreationEvents table in the Advanced hunting schema -description: Learn about the process spawning or creation events in the ProcessCreationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, processcreationevents, process id, command line +title: DeviceProcessEvents table in the Advanced hunting schema +description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# ProcessCreationEvents +# DeviceProcessEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ProcessCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The DeviceProcessEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -67,7 +67,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md similarity index 85% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index 05c6b7386b..fee6397cd2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -1,7 +1,7 @@ --- -title: RegistryEvents table in the Advanced hunting schema -description: Learn about registry events you can query from the RegistryEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, registryevents, registry, key, subkey, value +title: DeviceRegistryEvents table in the Advanced hunting schema +description: Learn about registry events you can query from the DeviceRegistryEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# RegistryEvents +# DeviceRegistryEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The RegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The DeviceRegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | RegistryKey | string | Registry key that the recorded action was applied to | | RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | @@ -57,7 +57,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | | InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 405215c2aa..33817ad10f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -33,16 +33,16 @@ In Microsoft Defender Security Center, go to **Advanced hunting** to run your fi ```kusto // Finds PowerShell execution events that could involve a download. -ProcessCreationEvents -| where EventTime > ago(7d) +DeviceProcessEvents +| where Timestamp > ago(7d) | where FileName in ("powershell.exe", "POWERSHELL.EXE", "powershell_ise.exe", "POWERSHELL_ISE.EXE") | where ProcessCommandLine has "Net.WebClient" or ProcessCommandLine has "DownloadFile" or ProcessCommandLine has "Invoke-WebRequest" or ProcessCommandLine has "Invoke-Shellcode" or ProcessCommandLine contains "http:" -| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine -| top 100 by EventTime +| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by Timestamp ``` This is how it will look like in Advanced hunting. @@ -54,16 +54,16 @@ The query starts with a short comment describing what it is for. This helps if y ```kusto // Finds PowerShell execution events that could involve a download. -ProcessCreationEvents +DeviceProcessEvents ``` -The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `ProcessCreationEvents` and add piped elements as needed. +The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `DeviceProcessEvents` and add piped elements as needed. ### Set the time range The first piped element is a time filter scoped within the previous seven days. Keeping the time range as narrow as possible ensures that queries perform well, return manageable results, and don't time out. ```kusto -| where EventTime > ago(7d) +| where Timestamp > ago(7d) ``` ### Search for specific executable files The time range is immediately followed by a search for files representing the PowerShell application. @@ -85,8 +85,8 @@ Afterwards, the query looks for command lines that are typically used with Power Now that your query clearly identifies the data you want to locate, you can add elements that define what the results look like. `project` returns specific columns and `top` limits the number of results, making the results well-formatted and reasonably large and easy to process. ```kusto -| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine -| top 100 by EventTime +| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by Timestamp ``` Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index 1ee69ec5ad..ad7829bfa9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -38,15 +38,15 @@ Table and column names are also listed within the Microsoft Defender Security Ce | Table name | Description | |------------|-------------| | **[AlertEvents](advanced-hunting-alertevents-table.md)** | Alerts on Microsoft Defender Security Center | -| **[MachineInfo](advanced-hunting-machineinfo-table.md)** | Machine information, including OS information | -| **[MachineNetworkInfo](advanced-hunting-machinenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | -| **[ProcessCreationEvents](advanced-hunting-processcreationevents-table.md)** | Process creation and related events | -| **[NetworkCommunicationEvents](advanced-hunting-networkcommunicationevents-table.md)** | Network connection and related events | -| **[FileCreationEvents](advanced-hunting-filecreationevents-table.md)** | File creation, modification, and other file system events | -| **[RegistryEvents](advanced-hunting-registryevents-table.md)** | Creation and modification of registry entries | -| **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events | -| **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events | -| **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | +| **[DeviceInfo](advanced-hunting-deviceinfo-table.md)** | Machine information, including OS information | +| **[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | +| **[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)** | Process creation and related events | +| **[DeviceNetworkEvents](advanced-hunting-devicenetworkevents-table.md)** | Network connection and related events | +| **[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)** | File creation, modification, and other file system events | +| **[DeviceRegistryEvents](advanced-hunting-deviceregistryevents-table.md)** | Creation and modification of registry entries | +| **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events | +| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events | +| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | | **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory | | **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory | | **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md index 736db7d11f..3fd747d1c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -34,8 +34,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| | Timestamp | datetime |Date and time when the record was generated | | ConfigurationId | string | Unique identifier for a specific configuration | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md index dc92507b8e..63fa5e1590 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -35,8 +35,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | | OSVersion | string | Version of the operating system running on the machine | | OSArchitecture | string | Architecture of the operating system running on the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index 2eaa43daee..cd73aee642 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -43,7 +43,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a ``` let - AdvancedHuntingQuery = "MiscEvents | where ActionType contains 'Anti'", + AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'", HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries", diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 772ce99ae9..84f22f9ef0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -51,7 +51,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-h Here is an example query: ```PowerShell -MiscEvents +DeviceEvents | where ActionType startswith 'Asr' ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index b751dd036f..44d145c9e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -56,7 +56,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query ```PowerShell -MiscEvents +DeviceEvents | where ActionType in ('ControlledFolderAccessViolationAudited','ControlledFolderAccessViolationBlocked') ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index fb3a52f9f4..854e4f2e9b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -34,17 +34,17 @@ Custom detection rules built from [Advanced hunting](advanced-hunting-overview.m In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results. #### Required columns in the query results -To use a query for a custom detection rule, the query must return the `EventTime`, `MachineId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. +To use a query for a custom detection rule, the query must return the `Timestamp`, `DeviceId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. -There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `MachineId`, you can still return `EventTime` and `ReportId` by getting them from the most recent event involving each machine. +There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `DeviceId`, you can still return `Timestamp` and `ReportId` by getting them from the most recent event involving each machine. -The sample query below counts the number of unique machines (`MachineId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `EventTime` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. +The sample query below counts the number of unique machines (`DeviceId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `Timestamp` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. ``` -MiscEvents -| where EventTime > ago(7d) +DeviceEvents +| where Timestamp > ago(7d) | where ActionType == "AntivirusDetection" -| summarize (EventTime, ReportId)=arg_max(EventTime, ReportId), count() by MachineId +| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | where count_ > 5 ``` @@ -76,7 +76,7 @@ Whenever a rule runs, similar detections on the same machine could be aggregated Your custom detection rule can automatically take actions on files or machines that are returned by the query. #### Actions on machines -These actions are applied to machines in the `MachineId` column of the query results: +These actions are applied to machines in the `DeviceId` column of the query results: - **Isolate machine** — applies full network isolation, preventing the machine from connecting to any application or service, except for the Microsoft Defender ATP service. [Learn more about machine isolation](respond-machine-alerts.md#isolate-machines-from-the-network) - **Collect investigation package** — collects machine information in a ZIP file. [Learn more about the investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines) - **Run antivirus scan** — performs a full Windows Defender Antivirus scan on the machine diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index e47d2c93c1..2642c7655d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -54,7 +54,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query: ```PowerShell -MiscEvents +DeviceEvents | where ActionType startswith 'ExploitGuard' and ActionType !contains 'NetworkProtection' ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index e1397a16e7..e66b4eade4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -99,7 +99,7 @@ Foreach($alert in $alerts) $commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","') -$query = "NetworkCommunicationEvents +$query = "DeviceNetworkEvents | where MachineId in ($commaSeparatedMachines) | where RemoteUrl == `"$suspiciousUrl`" | summarize ConnectionsCount = count() by MachineId" diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md index 7578bad95e..6f16b9a43a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md @@ -59,4 +59,4 @@ Learn how to use data sensitivity labels to prioritize incident investigation. >[!TIP] ->These data points are also exposed through the ‘FileCreationEvents’ in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status. \ No newline at end of file +>These data points are also exposed through the ‘DeviceFileEvents’ in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md index 487d24f359..4e7758c7da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md @@ -60,12 +60,12 @@ Event's information: ## Hunt for connection events using advanced hunting -All new connection events are available for you to hunt on through advanced hunting as well. Since these events are connection events, you can find them under the NetworkCommunicationEvents table under the `ConnecionSuccess` action type. +All new connection events are available for you to hunt on through advanced hunting as well. Since these events are connection events, you can find them under the DeviceNetworkEvents table under the `ConnecionSuccess` action type. Using this simple query will show you all the relevant events: ``` -NetworkCommunicationEvents +DeviceNetworkEvents | where ActionType == "ConnectionSuccess" | take 10 ``` @@ -77,7 +77,7 @@ You can also filter out events that are related to connection to the proxy itse Use the following query to filter out the connections to the proxy: ``` -NetworkCommunicationEvents +DeviceNetworkEvents | where ActionType == "ConnectionSuccess" and RemoteIP != "ProxyIP" | take 10 ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 6c0c0b5d21..b1a6786f57 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -57,7 +57,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query ```PowerShell -MiscEvents +DeviceEvents | where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 7173007d17..07e1d96848 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -46,7 +46,7 @@ The following features are included in the preview release: - [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). -- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. +- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index 8dc833cda8..bece592d00 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -81,7 +81,7 @@ Here is an example of the request. POST https://api.securitycenter.windows.com/api/advancedqueries/run Content-type: application/json { - "Query":"ProcessCreationEvents + "Query":"DeviceProcessEvents | where InitiatingProcessFileName =~ \"powershell.exe\" | where ProcessCommandLine contains \"appdata\" | project EventTime, FileName, InitiatingProcessFileName diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index e33a799eb0..15aded57d0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -70,7 +70,7 @@ where Run the following query: ``` -$query = 'RegistryEvents | limit 10' # Paste your own query here +$query = 'DeviceRegistryEvents | limit 10' # Paste your own query here $url = "https://api.securitycenter.windows.com/api/advancedqueries/run" $headers = @{ diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index f8b07f534c..6c4831e501 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -73,7 +73,7 @@ where Run the following query: ``` -query = 'RegistryEvents | limit 10' # Paste your own query here +query = 'DeviceRegistryEvents | limit 10' # Paste your own query here url = "https://api.securitycenter.windows.com/api/advancedqueries/run" headers = { diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 13b98ef44d..93c0a3388e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -173,11 +173,11 @@ DeviceTvmSoftwareInventoryVulnerabilities | join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId | where IsExploitAvailable == 1 and CvssScore >= 7 | summarize NumOfVulnerabilities=dcount(CveId), -ComputerName=any(ComputerName) by MachineId -| join kind =inner(AlertEvents) on MachineId +DeviceName=any(DeviceName) by DeviceId +| join kind =inner(AlertEvents) on DeviceId | summarize NumOfVulnerabilities=any(NumOfVulnerabilities), -ComputerName=any(ComputerName) by MachineId, AlertId -| project ComputerName, NumOfVulnerabilities, AlertId +DeviceName=any(DeviceName) by DeviceId, AlertId +| project DeviceName, NumOfVulnerabilities, AlertId | order by NumOfVulnerabilities desc ``` From 7b7d43e9d340c7cf91386461d22e03cd846cd5f1 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 16:37:49 -0800 Subject: [PATCH 009/335] Update advanced-hunting-deviceevents-table.md --- .../advanced-hunting-deviceevents-table.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 1acdf557bf..3f640784e5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,6 +1,6 @@ --- title: DeviceEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous events (DeviceEvents) table of the Advanced hunting schema +description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the Advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). From 2eb85ee3aaf78841d0acbd19d30e09d90fdfd56f Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 17:06:53 -0800 Subject: [PATCH 010/335] TOC & redir for ah schema change --- .openpublishing.redirection.json | 55 ++++++++++++++++++++--- windows/security/threat-protection/TOC.md | 18 ++++---- 2 files changed, 59 insertions(+), 14 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 551ce8b897..4852c7c178 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -956,6 +956,11 @@ "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", "redirect_document_id": false @@ -966,6 +971,51 @@ "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", "redirect_document_id": true @@ -1657,11 +1707,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", -"redirect_document_id": true -}, -{ "source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", "redirect_document_id": true diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 1df34b54fd..d3f9b8cf3b 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -114,15 +114,15 @@ #### [Advanced hunting schema reference]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) ##### [AlertEvents](microsoft-defender-atp/advanced-hunting-alertevents-table.md) -##### [FileCreationEvents](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) -##### [ImageLoadEvents](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) -##### [LogonEvents](microsoft-defender-atp/advanced-hunting-logonevents-table.md) -##### [MachineInfo](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) -##### [MachineNetworkInfo](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) -##### [MiscEvents](microsoft-defender-atp/advanced-hunting-miscevents-table.md) -##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) -##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) -##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md) +##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) +##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md) +##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md) +##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md) +##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md) +##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md) +##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md) +##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md) +##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md) ##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md) ##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md) ##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) From 3325a4ea9ea5cb0ead75e3eb4d80ce30e922f79e Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 17:31:13 -0800 Subject: [PATCH 011/335] Undo changes to API topics --- .../exposed-apis-full-sample-powershell.md | 4 ++-- .../microsoft-defender-atp/run-advanced-query-api.md | 2 +- .../run-advanced-query-sample-powershell.md | 2 +- .../run-advanced-query-sample-python.md | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index e66b4eade4..6314bce713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -32,7 +32,7 @@ In this section we share PowerShell samples to >**Prerequisite**: You first need to [create an app](apis-intro.md). -## Preparation Instructions +## Preparation instructions - Open a PowerShell window. - If your policy does not allow you to run the PowerShell commands, you can run the below command: @@ -99,7 +99,7 @@ Foreach($alert in $alerts) $commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","') -$query = "DeviceNetworkEvents +$query = "NetworkCommunicationEvents | where MachineId in ($commaSeparatedMachines) | where RemoteUrl == `"$suspiciousUrl`" | summarize ConnectionsCount = count() by MachineId" diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index bece592d00..8dc833cda8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -81,7 +81,7 @@ Here is an example of the request. POST https://api.securitycenter.windows.com/api/advancedqueries/run Content-type: application/json { - "Query":"DeviceProcessEvents + "Query":"ProcessCreationEvents | where InitiatingProcessFileName =~ \"powershell.exe\" | where ProcessCommandLine contains \"appdata\" | project EventTime, FileName, InitiatingProcessFileName diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index 15aded57d0..e33a799eb0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -70,7 +70,7 @@ where Run the following query: ``` -$query = 'DeviceRegistryEvents | limit 10' # Paste your own query here +$query = 'RegistryEvents | limit 10' # Paste your own query here $url = "https://api.securitycenter.windows.com/api/advancedqueries/run" $headers = @{ diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index 6c4831e501..f8b07f534c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -73,7 +73,7 @@ where Run the following query: ``` -query = 'DeviceRegistryEvents | limit 10' # Paste your own query here +query = 'RegistryEvents | limit 10' # Paste your own query here url = "https://api.securitycenter.windows.com/api/advancedqueries/run" headers = { From 2e8f3bd8986fd7811f1104d5d5c4a85d5be25c73 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 18:16:52 -0800 Subject: [PATCH 012/335] Name capping and backticks --- windows/security/threat-protection/TOC.md | 2 +- .../advanced-hunting-alertevents-table.md | 34 +++--- .../advanced-hunting-best-practices.md | 4 +- .../advanced-hunting-deviceevents-table.md | 101 +++++++++--------- ...advanced-hunting-devicefileevents-table.md | 88 +++++++-------- ...ced-hunting-deviceimageloadevents-table.md | 60 +++++------ .../advanced-hunting-deviceinfo-table.md | 38 +++---- ...dvanced-hunting-devicelogonevents-table.md | 76 ++++++------- ...anced-hunting-devicenetworkevents-table.md | 68 ++++++------ ...dvanced-hunting-devicenetworkinfo-table.md | 40 +++---- ...anced-hunting-deviceprocessevents-table.md | 84 +++++++-------- ...nced-hunting-deviceregistryevents-table.md | 64 +++++------ .../advanced-hunting-overview.md | 14 +-- .../advanced-hunting-query-language.md | 22 ++-- .../advanced-hunting-schema-reference.md | 20 ++-- .../advanced-hunting-shared-queries.md | 8 +- ...nced-hunting-tvm-configassessment-table.md | 26 ++--- ...vanced-hunting-tvm-secureconfigkb-table.md | 28 ++--- ...ced-hunting-tvm-softwareinventory-table.md | 28 ++--- ...hunting-tvm-softwarevulnerability-table.md | 24 ++--- .../attack-surface-reduction.md | 2 +- .../controlled-folders.md | 2 +- .../custom-detection-rules.md | 4 +- .../microsoft-defender-atp/evaluation-lab.md | 2 +- .../exploit-protection.md | 2 +- .../network-protection.md | 2 +- .../overview-custom-detections.md | 4 +- .../microsoft-defender-atp/preview.md | 2 +- .../threat-and-vuln-mgt-scenarios.md | 4 +- .../whats-new-in-microsoft-defender-atp.md | 4 +- 30 files changed, 429 insertions(+), 428 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d3f9b8cf3b..01d818fb3c 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -128,7 +128,7 @@ ##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) ##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md) #### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) -#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) +#### [Stream advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) #### [Custom detections]() ##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index b5e080a33e..e2792a2fb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -1,6 +1,6 @@ --- -title: AlertEvents table in the Advanced hunting schema -description: Learn about alert generation events in the AlertEvents table of the Advanced hunting schema +title: AlertEvents table in the advanced hunting schema +description: Learn about alert generation events in the AlertEvents table of the advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, alertevents, alert, severity, category search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,25 +26,25 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The AlertEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. +The `AlertEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| AlertId | string | Unique identifier for the alert | -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | -| Category | string | Type of threat indicator or breach activity identified by the alert | -| Title | string | Title of the alert | -| FileName | string | Name of the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteIP | string | IP address that was being connected to | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| Table | string | Table that contains the details of the event | +| `AlertId` | string | Unique identifier for the alert | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `Severity` | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | +| `Category` | string | Type of threat indicator or breach activity identified by the alert | +| `Title` | string | Title of the alert | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `RemoteIP` | string | IP address that was being connected to | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `Table` | string | Table that contains the details of the event | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index deb89add9d..5c0384c664 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -1,6 +1,6 @@ --- -title: Query best practices for Advanced hunting -description: Learn how to construct fast, efficient, and error-free threat hunting queries when using Advanced hunting +title: Query best practices for advanced hunting +description: Learn how to construct fast, efficient, and error-free threat hunting queries when using advanced hunting keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 3f640784e5..aed7f010df 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,7 +1,7 @@ --- title: DeviceEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard +description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard, MiscEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,58 +26,59 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous device events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or `DeviceEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| AccountDomain | string | Domain of the account | -| AccountName |string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | -| ProcessId | int | Process ID (PID) of the newly created process | -| ProcessCommandLine | string | Command line used to create the new process | -| ProcessCreationTime | datetime | Date and time the process was created | -| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RegistryKey | string | Registry key that the recorded action was applied to | -| RegistryValueName | string | Name of the registry value that the recorded action was applied to | -| RegistryValueData | string | Data of the registry value that the recorded action was applied to | -| RemoteIP | string | IP address that was being connected to | -| RemotePort | int | TCP port on the remote device that was being connected to | -| LocalIP | string | IP address assigned to the local machine used during communication | -| LocalPort | int | TCP port on the local machine used during communication | -| FileOriginUrl | string | URL where the file was downloaded from | -| FileOriginIP | string | IP address where the file was downloaded from | -| AdditionalFields | string | Additional information about the event in JSON array format | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `AccountDomain` | string | Domain of the account | +| `AccountName |string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| `ProcessId` | int | Process ID (PID) of the newly created process | +| `ProcessCommandLine` | string | Command line used to create the new process | +| `ProcessCreationTime` | datetime | Date and time the process was created | +| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `RegistryKey` | string | Registry key that the recorded action was applied to | +| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to | +| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to | +| `RemoteIP` | string | IP address that was being connected to | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `LocalIP` | string | IP address assigned to the local machine used during communication | +| `LocalPort` | int | TCP port on the local machine used during communication | +| `FileOriginUrl` | string | URL where the file was downloaded from | +| `FileOriginIP` | string | IP address where the file was downloaded from | +| `AdditionalFields` | string | Additional information about the event in JSON array format | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 08c61045ad..7e519fa914 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceFileEvents table in the Advanced hunting schema -description: Learn about file-related events in the DeviceFileEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5 +title: DeviceFileEvents table in the advanced hunting schema +description: Learn about file-related events in the DeviceFileEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5, FileCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,51 +26,51 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceFileEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The `DeviceFileEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| FileOriginUrl | string | URL where the file was downloaded from | -| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file | -| FileOriginIP | string | IP address where the file was downloaded from | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| RequestProtocol | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS | -| ShareName | string | Name of shared folder containing the file | -| RequestSourceIP | string | IPv4 or IPv6 address of the remote device that initiated the activity | -| RequestSourcePort | string | Source port on the remote device that initiated the activity | -| RequestAccountName | string | User name of account used to remotely initiate the activity | -| RequestAccountDomain | string | Domain of the account used to remotely initiate the activity | -| RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | -| SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | -| IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `FileOriginUrl` | string | URL where the file was downloaded from | +| `FileOriginReferrerUrl` | string | URL of the web page that links to the downloaded file | +| `FileOriginIP` | string | IP address where the file was downloaded from | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessIntegrityLevel` | string` | integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `RequestProtocol` | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS | +| `ShareName` | string | Name of shared folder containing the file | +| `RequestSourceIP` | string | IPv4 or IPv6 address of the remote device that initiated the activity | +| `RequestSourcePort` | string | Source port on the remote device that initiated the activity | +| `RequestAccountName` | string | User name of account used to remotely initiate the activity | +| `RequestAccountDomain` | string | Domain of the account used to remotely initiate the activity | +| `RequestAccountSid` | string | Security Identifier (SID) of the account to remotely initiate the activity | +| `ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `SensitivityLabel` | string | Label applied to an email, file, or other content to classify it for information protection | +| `SensitivitySubLabel` | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | +| `IsAzureInfoProtectionApplied` | boolean | Indicates whether the file is encrypted by Azure Information Protection | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index ebfd8dd80a..e8acfd67d4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceImageLoadEvents table in the Advanced hunting schema -description: Learn about DLL loading events in the DeviceImageLoadEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image +title: DeviceImageLoadEvents table in the advanced hunting schema +description: Learn about DLL loading events in the DeviceImageLoadEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image, ImageLoadEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,37 +26,37 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The `DeviceImageLoadEvents table` in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index 7d8fb7823b..16a90f67ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -1,7 +1,7 @@ --- -title: DeviceInfo table in the Advanced hunting schema -description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users +title: DeviceInfo table in the advanced hunting schema +description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users, MachineInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,26 +26,26 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The `DeviceInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ClientVersion | string | Version of the endpoint agent or sensor running on the machine | -| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | -| OSArchitecture | string | Architecture of the operating system running on the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | -| OSBuild | string | Build version of the operating system running on the machine | -| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | -| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| RegistryDeviceTag | string | Machine tag added through the registry | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| OSVersion | string | Version of the operating system running on the machine | -| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ClientVersion` | string | Version of the endpoint agent or sensor running on the machine | +| `PublicIP` | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | +| `OSArchitecture` | string | Architecture of the operating system running on the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | +| `OSBuild` | string | Build version of the operating system running on the machine | +| `IsAzureADJoined` | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | +| `LoggedOnUsers` | string | List of all users that are logged on the machine at the time of the event in JSON array format | +| `RegistryDeviceTag` | string | Machine tag added through the registry | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | +| `OSVersion` | string | Version of the operating system running on the machine | +| `MachineGroup` | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index 196bdde977..8177e49c74 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceLogonEvents table in the Advanced hunting schema -description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in +title: DeviceLogonEvents table in the advanced hunting schema +description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in, LogonEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,45 +26,45 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceLogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The `DeviceLogonEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string |Type of activity that triggered the event | -| AccountDomain | string | Domain of the account | -| AccountName | string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | -| RemoteIP | string | IP address that was being connected to | -| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| RemotePort | int | TCP port on the remote device that was being connected to | -| AdditionalFields | string | Additional information about the event in JSON array format | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string |Type of activity that triggered the event | +| `AccountDomain` | string | Domain of the account | +| `AccountName` | string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `LogonType` | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| `RemoteIP` | string | IP address that was being connected to | +| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `AdditionalFields` | string | Additional information about the event in JSON array format | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `IsLocalAdmin` | boolean | Boolean indicator of whether the user is a local administrator on the machine | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 581b173d15..0fe9b537f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceNetworkEvents table in the Advanced hunting schema -description: Learn about network connection events you can query from the DeviceNetworkEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip +title: DeviceNetworkEvents table in the advanced hunting schema +description: Learn about network connection events you can query from the DeviceNetworkEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip, NetworkCommunicationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,41 +26,41 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceNetworkEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The `DeviceNetworkEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| RemoteIP | string | IP address that was being connected to | -| RemotePort | int | TCP port on the remote device that was being connected to | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| LocalIP | string | IP address assigned to the local machine used during communication | -| LocalPort | int | TCP port on the local machine used during communication | -| Protocol | string | IP protocol used, whether TCP or UDP | -| LocalIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `RemoteIP` | string | IP address that was being connected to | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `LocalIP` | string | IP address assigned to the local machine used during communication | +| `LocalPort` | int | TCP port on the local machine used during communication | +| `Protocol` | string | IP protocol used, whether TCP or UDP | +| `LocalIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index 66f0663d23..e202a842bc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -1,7 +1,7 @@ --- -title: DeviceNetworkInfo table in the Advanced hunting schema -description: Learn about network configuration information in the DeviceNetworkInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel +title: DeviceNetworkInfo table in the advanced hunting schema +description: Learn about network configuration information in the DeviceNetworkInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel, MachineNetworkInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,27 +26,27 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The `DeviceNetworkInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| NetworkAdapterName | string | Name of the network adapter | -| MacAddress | string | MAC address of the network adapter | -| NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | -| NetworkAdapterStatus | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | -| TunnelType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | -| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | -| DnsAddresses | string | DNS server addresses in JSON array format | -| IPv4Dhcp | string | IPv4 address of DHCP server | -| IPv6Dhcp | string | IPv6 address of DHCP server | -| DefaultGateways | string | Default gateway addresses in JSON array format | -| IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `NetworkAdapterName` | string | Name of the network adapter | +| `MacAddress` | string | MAC address of the network adapter | +| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | +| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | +| `TunnelType` | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | +| `ConnectedNetworks` | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | +| `DnsAddresses` | string | DNS server addresses in JSON array format | +| `IPv4Dhcp` | string | IPv4 address of DHCP server | +| `IPv6Dhcp` | string | IPv6 address of DHCP server | +| `DefaultGateways` | string | Default gateway addresses in JSON array format | +| `IPAddresses` | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 42ed9a3829..71177a6205 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceProcessEvents table in the Advanced hunting schema -description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line +title: DeviceProcessEvents table in the advanced hunting schema +description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line, ProcessCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,49 +26,49 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceProcessEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The `DeviceProcessEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| ProcessId | int | Process ID (PID) of the newly created process | -| ProcessCommandLine | string | Command line used to create the new process | -| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources | -| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| ProcessCreationTime | datetime | Date and time the process was created | -| AccountDomain | string | Domain of the account | -| AccountName | string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `ProcessId` | int | Process ID (PID) of the newly created process | +| `ProcessCommandLine` | string | Command line used to create the new process | +| `ProcessIntegrityLevel` | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources | +| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| `ProcessCreationTime` | datetime | Date and time the process was created | +| `AccountDomain` | string | Domain of the account | +| `AccountName` | string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index fee6397cd2..396feb40c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceRegistryEvents table in the Advanced hunting schema -description: Learn about registry events you can query from the DeviceRegistryEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value +title: DeviceRegistryEvents table in the advanced hunting schema +description: Learn about registry events you can query from the DeviceRegistryEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value, RegistryEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,39 +26,39 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceRegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The `DeviceRegistryEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| RegistryKey | string | Registry key that the recorded action was applied to | -| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | -| RegistryValueName | string | Name of the registry value that the recorded action was applied to | -| RegistryValueData | string | Data of the registry value that the recorded action was applied to | -| PreviousRegistryValueName | string | Original name of the registry value before it was modified | -| PreviousRegistryValueData | string | Original data of the registry value before it was modified | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `RegistryKey` | string | Registry key that the recorded action was applied to | +| `RegistryValueType` | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | +| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to | +| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to | +| `PreviousRegistryValueName` | string | Original name of the registry value before it was modified | +| `PreviousRegistryValueData` | string | Original data of the registry value before it was modified | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 33df9bb93f..7211e19c61 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -1,5 +1,5 @@ --- -title: Overview of Advanced hunting +title: Overview of advanced hunting description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Proactively hunt for threats with Advanced hunting +# Proactively hunt for threats with advanced hunting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -28,9 +28,9 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. -## Get started with Advanced hunting +## Get started with advanced hunting -We recommend going through several steps to quickly get up and running with Advanced hunting. +We recommend going through several steps to quickly get up and running with advanced hunting. | Learning goal | Description | Resource | |--|--|--| @@ -41,7 +41,7 @@ We recommend going through several steps to quickly get up and running with Adva ## Get help as you write queries Take advantage of the following functionality to write queries faster: -- **Autosuggest** — as you write queries, Advanced hunting provides suggestions. +- **Autosuggest** — as you write queries, advanced hunting provides suggestions. - **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. ## Drilldown from query results @@ -54,14 +54,14 @@ Right-click a value in the result set to quickly enhance your query. You can use - Exclude the selected value from the query (`!=`) - Get more advanced operators for adding the value to your query, such as `contains`, `starts with` and `ends with` -![Image of Microsoft Defender ATP Advanced hunting result set](images/atp-advanced-hunting-results-filter.png) +![Image of Microsoft Defender ATP advanced hunting result set](images/atp-advanced-hunting-results-filter.png) ## Filter the query results The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude. -![Image of Advanced hunting filter](images/atp-filter-advanced-hunting.png) +![Image of advanced hunting filter](images/atp-filter-advanced-hunting.png) Once you apply the filter to modify the query and then run the query, the results are updated accordingly. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 33817ad10f..0b30e86cd8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -1,6 +1,6 @@ --- -title: Learn the Advanced hunting query language -description: Create your first threat hunting query and learn about common operators and other aspects of the Advanced hunting query language +title: Learn the advanced hunting query language +description: Create your first threat hunting query and learn about common operators and other aspects of the advanced hunting query language keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,14 +18,14 @@ ms.topic: article ms.date: 10/08/2019 --- -# Learn the Advanced hunting query language +# Learn the advanced hunting query language **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for Advanced hunting. To understand these concepts better, run your first query. +Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for advanced hunting. To understand these concepts better, run your first query. ## Try your first query @@ -45,9 +45,9 @@ DeviceProcessEvents | top 100 by Timestamp ``` -This is how it will look like in Advanced hunting. +This is how it will look like in advanced hunting. -![Image of Microsoft Defender ATP Advanced hunting query](images/advanced-hunting-query-example.png) +![Image of Microsoft Defender ATP advanced hunting query](images/advanced-hunting-query-example.png) ### Describe the query and specify the table to search The query starts with a short comment describing what it is for. This helps if you later decide to save your query and share it with others in your organization. @@ -91,9 +91,9 @@ Now that your query clearly identifies the data you want to locate, you can add Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results. -## Learn common query operators for Advanced hunting +## Learn common query operators for advanced hunting -Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by Advanced hunting supports a range of operators, including the following common ones. +Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by advanced hunting supports a range of operators, including the following common ones. | Operator | Description and usage | |--|--| @@ -108,11 +108,11 @@ Now that you've run your first query and have a general idea of its components, | **makeset** | Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group. | | **find** | Find rows that match a predicate across a set of tables. | -To see a live example of these operators, run them from the **Get started** section of the Advanced hunting page. +To see a live example of these operators, run them from the **Get started** section of the advanced hunting page. ## Understand data types -Data in Advanced hunting tables are generally classified into the following data types. +Data in advanced hunting tables are generally classified into the following data types. | Data type | Description and query implications | |--|--| @@ -126,7 +126,7 @@ Data in Advanced hunting tables are generally classified into the following data The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them. -![Image of Advanced hunting window](images/atp-advanced-hunting.png) +![Image of advanced hunting window](images/atp-advanced-hunting.png) > [!NOTE] > Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index ad7829bfa9..8fd07c3b19 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -1,6 +1,6 @@ --- -title: Advanced hunting schema reference -description: Learn about the tables in the Advanced hunting schema to understand the data you can run threat hunting queries on +title: advanced hunting schema reference +description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, data search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Understand the Advanced hunting schema +# Understand the advanced hunting schema **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -27,13 +27,13 @@ ms.date: 10/08/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. +The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. ## Schema tables -The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table. +The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table. -Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the Advanced hunting screen. +Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the advanced hunting screen. | Table name | Description | |------------|-------------| @@ -47,10 +47,10 @@ Table and column names are also listed within the Microsoft Defender Security Ce | **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events | | **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events | | **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | -| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory | -| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory | -| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information | -| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Basis of security configuration assessment such as security industry standards and benchmarks | +| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products | +| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available | +| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices | +| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index d32a485fd7..c086fd1418 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -1,5 +1,5 @@ --- -title: Use shared queries in Advanced hunting +title: Use shared queries in advanced hunting description: Start threat hunting immediately with predefined and shared queries. Share your queries to the public or to your organization. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries search.product: eADQiWindows 10XVcnh @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Use shared queries in Advanced hunting +# Use shared queries in advanced hunting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -54,10 +54,10 @@ You can save a new or existing query so that it is only accessible to you or sha 2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. ## Access queries in the GitHub repository -Microsoft security researchers regularly share Advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). +Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). >[!TIP] ->Microsoft security researchers also provide Advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center. +>Microsoft security researchers also provide advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center. ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md index 3fd747d1c7..ba92db654a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema -description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information. +title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema +description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,21 +28,21 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. +Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| -| Timestamp | datetime |Date and time when the record was generated | -| ConfigurationId | string | Unique identifier for a specific configuration | -| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | -| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | -| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| +| `Timestamp` | datetime |Date and time when the record was generated | +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md index 5da1e8e986..9ea78ad918 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema -description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema. +title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema +description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,22 +28,22 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. +The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| ConfigurationId | string | Unique identifier for a specific configuration | -| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | -| ConfigurationName | string | Display name of the configuration | -| ConfigurationDescription | string | Description of the configuration | -| RiskDescription | string | Description of the associated risk | -| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| -| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration | -| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques related to the configuration | -| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics related to the configuration | +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `ConfigurationName` | string | Display name of the configuration | +| `ConfigurationDescription` | string | Description of the configuration | +| `RiskDescription` | string | Description of the associated risk | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration | +| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration | +| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md index 63fa5e1590..ff9eac991d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema -description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the Advanced hunting schema. +title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema +description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -29,22 +29,22 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. +The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | -| OSVersion | string | Version of the operating system running on the machine | -| OSArchitecture | string | Architecture of the operating system running on the machine | -| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | -| SoftwareName | string | Name of the software product | -| SoftwareVersion | string | Version number of the software product | -| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | +| `OSVersion` | string | Version of the operating system running on the machine | +| `OSArchitecture` | string | Architecture of the operating system running on the machine | +| `SoftwareVendor` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `SoftwareName` | string | Name of the software product | +| `SoftwareVersion` | string | Version number of the software product | +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md index 754894ddbf..902684edc0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema -description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the Advanced hunting schema. +title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema +description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,20 +28,20 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. +The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | -| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available | -| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | -| LastModifiedTime | datetime | Date and time the item or related metadata was last modified | -| PublishedDate | datetime | Date vulnerability was disclosed to public | -| VulnerabilityDescription | string | Description of vulnerability and associated risks | -| AffectedSoftware | string | List of all software products affected by the vulnerability | +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | +| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified | +| `PublishedDate` | datetime | Date vulnerability was disclosed to public | +| `VulnerabilityDescription` | string | Description of vulnerability and associated risks | +| `AffectedSoftware` | string | List of all software products affected by the vulnerability | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 84f22f9ef0..e4e202f76f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -46,7 +46,7 @@ For information about configuring attack surface reduction rules, see [Enable at Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-hunting-query-language.md). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to understand how attack surface reduction rules could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-hunting-query-language.md). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to understand how attack surface reduction rules could affect your environment. Here is an example query: diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 44d145c9e9..ae15f3e5c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -51,7 +51,7 @@ Controlled folder access requires enabling [Windows Defender Antivirus real-time Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. Here is an example query diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 854e4f2e9b..90c461b3d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -117,7 +117,7 @@ You can also take the following actions on the rule from this page: - **Run** — run the rule immediately. This also resets the interval for the next run. - **Edit** — modify the rule without changing the query -- **Modify query** — edit the query in Advanced hunting +- **Modify query** — edit the query in advanced hunting - **Turn on** / **Turn off** — enable the rule or stop it from running - **Delete** — turn off the rule and remove it @@ -127,5 +127,5 @@ You can also take the following actions on the rule from this page: ## Related topic - [Custom detections overview](overview-custom-detections.md) - [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the Advanced hunting query language](advanced-hunting-query-language.md) +- [Learn the advanced hunting query language](advanced-hunting-query-language.md) - [View and organize alerts](alerts-queue.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index c7ae3aac79..ccab9e8250 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -152,7 +152,7 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query After running your simulations, we encourage you to walk through the lab progress bar and explore Microsoft Defender ATP features. See if your attacks triggered an automated investigation and remediation, check out the evidence collected and analyzed by the feature. -Hunt for attack evidence through Advanced hunting by using the rich query language and raw telemetry and check out some world-wide threats documented in Threat analytics. +Hunt for attack evidence through advanced hunting by using the rich query language and raw telemetry and check out some world-wide threats documented in Threat analytics. ## Simulation results diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index 2642c7655d..29df4eb11a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -49,7 +49,7 @@ Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](http Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how exploit protection settings could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how exploit protection settings could affect your environment. Here is an example query: diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index b1a6786f57..cdcb26b8fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -52,7 +52,7 @@ Windows 10 version 1709 or later | [Windows Defender AV real-time protection](.. Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how network protection settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how network protection settings would affect your environment if they were enabled. Here is an example query diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index 03e0f5ca62..470e593502 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -1,7 +1,7 @@ --- title: Overview of custom detections in Microsoft Defender ATP ms.reviewer: -description: Understand how you can use Advanced hunting to create custom detections and generate alerts +description: Understand how you can use advanced hunting to create custom detections and generate alerts keywords: custom detections, alerts, detection rules, advanced hunting, hunt, query, response actions, interval, mdatp, microsoft defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,7 +28,7 @@ With custom detections, you can proactively monitor for and respond to various e Custom detections work with [Advanced hunting](advanced-hunting-overview.md), which provides a powerful, flexible query language that covers a broad set of event and system information from your network. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches. Custom detections provide: -- Alerts for rule-based detections built from Advanced hunting queries +- Alerts for rule-based detections built from advanced hunting queries - Automatic response actions that apply to files and machines >[!NOTE] diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 07e1d96848..a092af970c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -46,7 +46,7 @@ The following features are included in the preview release: - [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). -- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. +- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 93c0a3388e..df23634446 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -159,7 +159,7 @@ When an exception is created for a recommendation, the recommendation is no long 6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). ![Screenshot of exception list of exceptions in the Remediation page](images/tvm-exception-list.png) -## Use Advanced hunting query to search for machines with High active alerts or critical CVE public exploit +## Use advanced hunting query to search for machines with High active alerts or critical CVE public exploit 1. Go to **Advanced hunting** from the left-hand navigation pane. @@ -193,5 +193,5 @@ DeviceName=any(DeviceName) by DeviceId, AlertId - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) +- [All advanced hunting tables](advanced-hunting-reference.md) - [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 7e542c0b65..252b58265c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -94,7 +94,7 @@ For more information preview features, see [Preview features](https://docs.micro - [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard)
Controlled folder access is now supported on Windows Server 2019. -- [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections)
With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. +- [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections)
With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of advanced hunting through the creation of custom detection rules. - [Integration with Azure Security Center](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#integration-with-azure-security-center)
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. @@ -120,7 +120,7 @@ Threat Analytics is a set of interactive reports published by the Microsoft Defe ## March 2018 - [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
-Query data using Advanced hunting in Microsoft Defender ATP. +Query data using advanced hunting in Microsoft Defender ATP. - [Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
New attack surface reduction rules: From f8ba6714c320ba76defb672f00c1de04441e77b1 Mon Sep 17 00:00:00 2001 From: NagaCSC Date: Mon, 16 Dec 2019 09:20:27 -0800 Subject: [PATCH 013/335] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md looks good, please proceed further Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-base.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 37e65c43d4..927449551f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -58,7 +58,8 @@ To resolve this issue, the CRL distribution point must be a location that is acc If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points. -Note: If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. +> [!NOTE] +> If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. ### Windows Server 2016 Domain Controllers If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -339,4 +340,3 @@ Sign-in a workstation with access equivalent to a _domain user_. If you plan on using certificates for on-premises single-sign on, perform the additional steps in [Using Certificates for On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). - From a922ae24ab54104b41a6f1f8025e28a0f71ccc47 Mon Sep 17 00:00:00 2001 From: NagaCSC Date: Mon, 16 Dec 2019 14:25:15 -0800 Subject: [PATCH 014/335] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-base.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 927449551f..f6f3f40c4b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -154,7 +154,6 @@ These procedures configure NTFS and share permissions on the web server to allow ![CDP Share Permissions](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. - #### Disable Caching 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. @@ -339,4 +338,3 @@ Sign-in a workstation with access equivalent to a _domain user_. If you plan on using certificates for on-premises single-sign on, perform the additional steps in [Using Certificates for On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). - From 461d264ccfc7659096504d240df21884eff1adb0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:19:16 -0800 Subject: [PATCH 015/335] Create why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md new file mode 100644 index 0000000000..9be9c9e46b --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -0,0 +1,21 @@ +--- +title: Why you should use Windows Defender Antivirus +description: For best results, use Windows Defender Antivirus together with your other Microsoft offerings. +keywords: windows defender, antivirus +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: denisebmsft +ms.author: deniseb +ms.custom: nextgen +ms.date: 12/16/2019 +ms.reviewer: +manager: dansimp +--- + +# 10 good reasons to use Windows Defender Antivirus + From 292c733577dd0861301b851525ea2df78dfa957c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:20:13 -0800 Subject: [PATCH 016/335] Update TOC.md --- windows/security/threat-protection/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 1df34b54fd..04fa998be4 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -42,6 +42,7 @@ #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) ### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [10 good reasons to use Windows Defender Antivirus](windows-defender-antivirus/why-use-microsoft-antivirus.md) ### [Endpoint detection and response]() #### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) From 29d4bd1b3c02fbcdb74b95604914b92a5d484bf6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:22:00 -0800 Subject: [PATCH 017/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 9be9c9e46b..0f00488c07 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -1,5 +1,5 @@ --- -title: Why you should use Windows Defender Antivirus +title: Why you should use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection description: For best results, use Windows Defender Antivirus together with your other Microsoft offerings. keywords: windows defender, antivirus search.product: eADQiWindows 10XVcnh @@ -17,5 +17,7 @@ ms.reviewer: manager: dansimp --- -# 10 good reasons to use Windows Defender Antivirus +# 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection + + From a30c0bf942e3a403c744abd3a9bee24d33d61ee9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:28:35 -0800 Subject: [PATCH 018/335] Update why-use-microsoft-antivirus.md --- .../windows-defender-antivirus/why-use-microsoft-antivirus.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 0f00488c07..9d1b5915b0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -19,5 +19,7 @@ manager: dansimp # 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection +Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can integrate non-Microsoft antivirus offerings with Microsoft Defender ATP, there are at least 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP. This article summarizes those reasons and provides links to additional information. + From 404485293ea8bcbcd6d7cdc9b9ac1d4873f91c8e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:40:56 -0800 Subject: [PATCH 019/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 9d1b5915b0..55818c1fba 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -19,7 +19,20 @@ manager: dansimp # 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection -Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can integrate non-Microsoft antivirus offerings with Microsoft Defender ATP, there are at least 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP. This article summarizes those reasons and provides links to additional information. +Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can use a non-Microsoft antivirus offering with Microsoft Defender ATP, there are certain advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. + +The following table summarizes 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP. + +|Item |Description | +|--|--| +|File recovery via OneDrive |If your device is attacked by ransomware and protection through Windows Defender Antivirus with Microsoft Defender ATP is in place, your files are protected and recoverable. | +|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. | +|File blocking |Your organization's security team can block specific files. | +|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus.) | +|Details about blocked malware | | + + + From bbb471f0915c0ccc32e55ffeb379efac7b14ccf4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:42:58 -0800 Subject: [PATCH 020/335] Update TOC.md --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 04fa998be4..b82183f8e1 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -42,7 +42,7 @@ #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) ### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) -#### [10 good reasons to use Windows Defender Antivirus](windows-defender-antivirus/why-use-microsoft-antivirus.md) +#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) ### [Endpoint detection and response]() #### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) From 9f80e7c29e334a753b8ce9685a048deda1cb6595 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 15:49:53 -0800 Subject: [PATCH 021/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 55818c1fba..3398562837 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -25,9 +25,9 @@ The following table summarizes 10 good reasons to use Windows Defender Antivirus |Item |Description | |--|--| -|File recovery via OneDrive |If your device is attacked by ransomware and protection through Windows Defender Antivirus with Microsoft Defender ATP is in place, your files are protected and recoverable. | -|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. | -|File blocking |Your organization's security team can block specific files. | +|File recovery via OneDrive |If you are using Office 365 and your device is attacked by ransomware, with Windows Defender Antivirus in place, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| +|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| +|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| |Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus.) | |Details about blocked malware | | From e3330282ee896d152d25f6b850f9d9d95676da1e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:03:06 -0800 Subject: [PATCH 022/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 3398562837..1c30dcc1bc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -17,19 +17,22 @@ ms.reviewer: manager: dansimp --- -# 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender Advanced Threat Protection +# Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can use a non-Microsoft antivirus offering with Microsoft Defender ATP, there are certain advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. -The following table summarizes 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP. +## Reasons to use Windows Defender Antivirus together with Microsoft Defender ATP |Item |Description | |--|--| -|File recovery via OneDrive |If you are using Office 365 and your device is attacked by ransomware, with Windows Defender Antivirus in place, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| +|File recovery via OneDrive |If you are using Windows Defender Antivirus together with Office 365, and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| |Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| |File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| -|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus.) | -|Details about blocked malware | | +|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | +|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| +| | | + +## Learn more From 98ca2ad318b5ccdd3e7f2a8445c65c5992d38637 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:08:39 -0800 Subject: [PATCH 023/335] Update why-use-microsoft-antivirus.md --- .../windows-defender-antivirus/why-use-microsoft-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 1c30dcc1bc..705812e263 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -30,7 +30,7 @@ Windows Defender Antivirus is the next-generation protection component of [Micro |File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| |Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | |Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| -| | | +|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information than would be available with non-Microsoft antivirus offerings. | ## Learn more From 117de2dd4594e6285c630de94bfe3792e8c89fa8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:21:20 -0800 Subject: [PATCH 024/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 705812e263..9bb5701701 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -30,7 +30,11 @@ Windows Defender Antivirus is the next-generation protection component of [Micro |File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| |Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | |Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| -|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information than would be available with non-Microsoft antivirus offerings. | +|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | +|Geographic location |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | +|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. | +|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. | +|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. | ## Learn more From fd5ea9a12e1731d76979662ed8f0239873592aeb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:34:54 -0800 Subject: [PATCH 025/335] Update why-use-microsoft-antivirus.md --- .../why-use-microsoft-antivirus.md | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 9bb5701701..76a9dc4531 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -21,23 +21,27 @@ manager: dansimp Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can use a non-Microsoft antivirus offering with Microsoft Defender ATP, there are certain advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. -## Reasons to use Windows Defender Antivirus together with Microsoft Defender ATP +## 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP -|Item |Description | -|--|--| -|File recovery via OneDrive |If you are using Windows Defender Antivirus together with Office 365, and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| -|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| -|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| -|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | -|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| -|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | -|Geographic location |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | -|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. | -|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. | -|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. | +| |Item |Description | +|--|--|--| +|1|File recovery via OneDrive |If you are using Windows Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise/), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| +|2|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| +|3|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| +|4|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | +|5|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| +|6|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | +|7|Geographic location |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | +|8|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Windows Defender Antivirus](evaluate-windows-defender-antivirus.md) and [Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md).| +|9|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). | +|10|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | ## Learn more +[Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) + +[Threat & Vulnerability Management](../microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) + From 8e25b143b8f90103e8e4b755e735250fc135a316 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:35:24 -0800 Subject: [PATCH 026/335] Update why-use-microsoft-antivirus.md --- .../windows-defender-antivirus/why-use-microsoft-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 76a9dc4531..37c4870a73 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -29,7 +29,7 @@ Windows Defender Antivirus is the next-generation protection component of [Micro |2|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| |3|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| |4|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | -|5|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. For example, NEED AN EXAMPLE HERE. [Understand malware & other threats](../intelligence/understanding-malware.md).| +|5|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).| |6|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | |7|Geographic location |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | |8|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Windows Defender Antivirus](evaluate-windows-defender-antivirus.md) and [Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md).| From 3e2a9b4403449438dab86dcecd4d9eb373157a78 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:36:49 -0800 Subject: [PATCH 027/335] Update why-use-microsoft-antivirus.md --- .../windows-defender-antivirus/why-use-microsoft-antivirus.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 37c4870a73..62477a4bd2 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -19,6 +19,10 @@ manager: dansimp # Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can use a non-Microsoft antivirus offering with Microsoft Defender ATP, there are certain advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. ## 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP From aab308ea39ec4f5ab559d64368f3a681040b525c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 16 Dec 2019 16:37:42 -0800 Subject: [PATCH 028/335] Update why-use-microsoft-antivirus.md --- .../windows-defender-antivirus/why-use-microsoft-antivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index 62477a4bd2..f67ed7f3d9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -34,8 +34,8 @@ Windows Defender Antivirus is the next-generation protection component of [Micro |3|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| |4|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | |5|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).| -|6|Threat analytics and Secure Score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | -|7|Geographic location |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | +|6|Threat analytics and your secure score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | +|7|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | |8|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Windows Defender Antivirus](evaluate-windows-defender-antivirus.md) and [Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md).| |9|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). | |10|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | From 77803dc434f7ce49365f804b16295c23f2705f3a Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Tue, 17 Dec 2019 17:38:22 -0800 Subject: [PATCH 029/335] first pass --- .../windows-autopilot-and-surface-devices.md | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index 6e16d59968..e5604d898a 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -1,5 +1,5 @@ --- -title: Windows Autopilot and Surface Devices +title: Windows Autopilot and Surface devices ms.reviewer: manager: dansimp description: Find out about Windows Autopilot deployment options for Surface devices. @@ -18,21 +18,27 @@ ms.date: 11/26/2019 # Windows Autopilot and Surface devices -Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as a hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM). +Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box. Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. Device are automatically enrolled and configured by using modern management solutions such as Azure Active Directory (AAD) and mobile device management. -With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process eliminates need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution. +With Surface, you can choose to register your devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. New devices can be shipped directly to your end-users. The devices will be automatically enrolled and configured when they are unboxed and turned on for the first time. This process eliminates the need to reimage devices as part of deployment, which which allows you to implement new, agile methods for device management and distribution. ## Modern management Autopilot is the recommended deployment option for Surface devices including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed to be deployed with Autopilot. - For the best experience, enroll your Surface devices with the assistance of a Microsoft Cloud Solution Provider. Doing so enables you to manage UEFI firmware settings on Surface devices directly from Intune, eliminating the need to physically touch devices for certificate management. For more information, see [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). + For the best experience, enroll your Surface devices with the assistance of a Microsoft Cloud Solution Provider. That method allows you to manage UEFI firmware settings on Surface devices directly from Intune, eliminating the need to physically touch devices for certificate management. For more information, see [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). ## Windows version considerations -Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update) or later. These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. All new Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3 ship with Windows 10 Version 1903 or above. +Broad deployment of Surface devices through Windows Autopilot, including enrollment by Surface partners at the time of purchase, requires Windows 10 Version 1709 (Fall Creators Update) or later. + + These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that's necessary for deployments at scale. All new Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. ## Surface partners enabled for Windows Autopilot -Enrolling Surface devices in Windows Autopilot at the time of purchase is performed by select Surface partners that enroll devices on an organization’s behalf. Devices can then be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management. -Surface partners enabled for Windows Autopilot include: + +Select Surface partners can enroll Surface devices in Windows Autopilot at the time of purchase for your organization. + +These partners can ship enrolled devices directly to your users. And the devices can be configured entirely through the zero-touch process of Windows Autopilot, Azure AD, and mobile device management. + +Surface partners enabled for Windows Autopilot include: - [ALSO](https://www.also.com/ec/cms5/de_1010/1010_anbieter/microsoft/windows-autopilot/index.jsp) - [Atea](https://www.atea.com/) From 37b207227c087b8932ee4f470c42cb370d67da84 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 18 Dec 2019 15:37:56 +0500 Subject: [PATCH 030/335] Update select-types-of-rules-to-create.md --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 9633a7cf60..f6ea23a20f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -67,7 +67,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| | **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | | **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | -| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection of enforcing user-writeability and only allowing admin-writeable locations. | +| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by administrator) for the path pecified in the FilePathRule parameter of the New-CIPolicyRule cmdlet. | | **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | ## Windows Defender Application Control file rule levels From 2f510c024ba19f6a9a34322031f688e01500d363 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Wed, 18 Dec 2019 15:23:27 -0800 Subject: [PATCH 031/335] second pass pass --- .../windows-autopilot-and-surface-devices.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index e5604d898a..e774a14b45 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -18,27 +18,29 @@ ms.date: 11/26/2019 # Windows Autopilot and Surface devices -Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box. Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. Device are automatically enrolled and configured by using modern management solutions such as Azure Active Directory (AAD) and mobile device management. +Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box. -With Surface, you can choose to register your devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. New devices can be shipped directly to your end-users. The devices will be automatically enrolled and configured when they are unboxed and turned on for the first time. This process eliminates the need to reimage devices as part of deployment, which which allows you to implement new, agile methods for device management and distribution. +Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. They're automatically enrolled and configured by using modern management solutions such as Azure Active Directory (AAD) and mobile device management. + +You can register Surface devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. These partners can ship new devices directly to your users. The devices will be automatically enrolled and configured when they are first turned on. This process eliminates reimaging during deployment, which lets you implement new, agile methods of device management and distribution. ## Modern management -Autopilot is the recommended deployment option for Surface devices including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed to be deployed with Autopilot. +Autopilot is the recommended deployment option for Surface devices including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed to be deployed through Autopilot. - For the best experience, enroll your Surface devices with the assistance of a Microsoft Cloud Solution Provider. That method allows you to manage UEFI firmware settings on Surface devices directly from Intune, eliminating the need to physically touch devices for certificate management. For more information, see [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md). + For the best experience, enroll your Surface devices with the help of a Microsoft Cloud Solution Provider. That method allows you to manage UEFI firmware settings on Surface directly from Intune. It eliminates the need to physically touch devices for certificate management. See [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) for details. ## Windows version considerations Broad deployment of Surface devices through Windows Autopilot, including enrollment by Surface partners at the time of purchase, requires Windows 10 Version 1709 (Fall Creators Update) or later. - These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that's necessary for deployments at scale. All new Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. +These versions support a 4,000-byte (4k) hash value to uniquely identify devices for Windows Autopilot, which is necessary for deployments at scale. All new Surface devices, including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. ## Surface partners enabled for Windows Autopilot -Select Surface partners can enroll Surface devices in Windows Autopilot at the time of purchase for your organization. +Select Surface partners can enroll Surface devices in Windows Autopilot at the time of purchase for your organization. These partners can ship enrolled devices directly to your users. And the devices can be configured entirely through the zero-touch process of Windows Autopilot, Azure AD, and mobile device management. -Surface partners enabled for Windows Autopilot include: +Surface partners enabled for Windows Autopilot include: - [ALSO](https://www.also.com/ec/cms5/de_1010/1010_anbieter/microsoft/windows-autopilot/index.jsp) - [Atea](https://www.atea.com/) @@ -53,6 +55,6 @@ Surface partners enabled for Windows Autopilot include: - [Techdata](https://www.techdata.com/) ## Learn more -For more information about Windows Autopilot, refer to: +For more information about Windows Autopilot, see: - [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) - [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements) \ No newline at end of file From 2b735e5c482925c4a3ca42ab7641e017ddc7c966 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Wed, 18 Dec 2019 16:27:19 -0800 Subject: [PATCH 032/335] proof --- .../windows-autopilot-and-surface-devices.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index e774a14b45..36283c8d84 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -20,27 +20,25 @@ ms.date: 11/26/2019 Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box. -Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. They're automatically enrolled and configured by using modern management solutions such as Azure Active Directory (AAD) and mobile device management. +Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. They're automatically enrolled and configured by using modern management solutions such as Azure Active Directory (Azure AD) and mobile device management. You can register Surface devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. These partners can ship new devices directly to your users. The devices will be automatically enrolled and configured when they are first turned on. This process eliminates reimaging during deployment, which lets you implement new, agile methods of device management and distribution. ## Modern management -Autopilot is the recommended deployment option for Surface devices including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed to be deployed through Autopilot. +Autopilot is the recommended deployment option for Surface devices, including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed for deployment through Autopilot. - For the best experience, enroll your Surface devices with the help of a Microsoft Cloud Solution Provider. That method allows you to manage UEFI firmware settings on Surface directly from Intune. It eliminates the need to physically touch devices for certificate management. See [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) for details. + It's best to enroll your Surface devices with the help of a Microsoft Cloud Solution Provider. This step allows you to manage UEFI firmware settings on Surface directly from Intune. It eliminates the need to physically touch devices for certificate management. See [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) for details. ## Windows version considerations Broad deployment of Surface devices through Windows Autopilot, including enrollment by Surface partners at the time of purchase, requires Windows 10 Version 1709 (Fall Creators Update) or later. -These versions support a 4,000-byte (4k) hash value to uniquely identify devices for Windows Autopilot, which is necessary for deployments at scale. All new Surface devices, including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. +These Windows versions support a 4,000-byte (4k) hash value that uniquely identifies devices for Windows Autopilot, which is necessary for deployments at scale. All new Surface devices, including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later. ## Surface partners enabled for Windows Autopilot -Select Surface partners can enroll Surface devices in Windows Autopilot at the time of purchase for your organization. +Select Surface partners can enroll Surface devices in Windows Autopilot for you at the time of purchase. They can also ship enrolled devices directly to your users. The devices can be configured entirely through a zero-touch process by using Windows Autopilot, Azure AD, and mobile device management. -These partners can ship enrolled devices directly to your users. And the devices can be configured entirely through the zero-touch process of Windows Autopilot, Azure AD, and mobile device management. - -Surface partners enabled for Windows Autopilot include: +Surface partners that are enabled for Windows Autopilot include: - [ALSO](https://www.also.com/ec/cms5/de_1010/1010_anbieter/microsoft/windows-autopilot/index.jsp) - [Atea](https://www.atea.com/) From 407a518cfb5a26b80c46022c76069441fbeb80d7 Mon Sep 17 00:00:00 2001 From: Mark Goodman <19527097+silvermarkg@users.noreply.github.com> Date: Thu, 19 Dec 2019 12:32:53 +0000 Subject: [PATCH 033/335] Updated deferral period for quality updates Deferral period for quality updates was incorrect. Document showed 35 days when deferral is for a maximum of 30 days. --- windows/deployment/update/waas-configure-wufb.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 81adf9756d..cb057d2994 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -125,7 +125,7 @@ Starting with Windows 10, version 1703, using Settings to control the pause beha ## Configure when devices receive Quality Updates -Quality Updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 35 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. +Quality Updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 30 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. You can set your system to receive updates for other Microsoft products—known as Microsoft Updates (such as Microsoft Office, Visual Studio)—along with Windows Updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft Updates will follow the same deferral and pause rules as all other Quality Updates. From 0c8e00a7c9c9e683d1c044ede5e0843187f9fa62 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Dec 2019 15:53:56 -0800 Subject: [PATCH 034/335] Update why-use-microsoft-antivirus.md Dan's edits --- .../why-use-microsoft-antivirus.md | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md index f67ed7f3d9..453c51417a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus.md @@ -23,22 +23,25 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). Although you can use a non-Microsoft antivirus offering with Microsoft Defender ATP, there are certain advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. +Windows Defender Antivirus is the next-generation protection component of [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) (Microsoft Defender ATP). -## 10 good reasons to use Windows Defender Antivirus together with Microsoft Defender ATP +Although you can use a non-Microsoft antivirus solution with Microsoft Defender ATP, there are advantages to using Windows Defender Antivirus together with Microsoft Defender ATP. Not only is it an excellent, next-generation antivirus solution, but combined with other Microsoft Defender ATP capabilities, such as Endpoint Detection and Response and Automated Investigation and Remediation, you'll see better protection that's coordinated across products. + +## 10 reasons to use Windows Defender Antivirus together with Microsoft Defender ATP | |Item |Description | |--|--|--| -|1|File recovery via OneDrive |If you are using Windows Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise/), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| -|2|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| -|3|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| -|4|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | -|5|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).| -|6|Threat analytics and your secure score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | -|7|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | -|8|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Windows Defender Antivirus](evaluate-windows-defender-antivirus.md) and [Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md).| -|9|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). | -|10|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | +|1|Antivirus signal sharing |Microsoft applications and services share signals across your enterprise organization, providing a stronger single platform. See [Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). | +|2|Threat analytics and your secure score |Windows Defender Antivirus collects underlying system data used by [threat analytics](../microsoft-defender-atp/threat-analytics.md) and [secure score](../microsoft-defender-atp/overview-secure-score.md). This provides your organization's security team with more meaningful information, such as recommendations and opportunities to improve your organization's security posture. | +|3|Performance |Microsoft Defender ATP is designed to work with Windows Defender Antivirus, so you get better performance when you use these offerings together. [Evaluate Windows Defender Antivirus](evaluate-windows-defender-antivirus.md) and [Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md).| +|4|Details about blocked malware |More details and actions for blocked malware are available with Windows Defender Antivirus and Microsoft Defender ATP. [Understand malware & other threats](../intelligence/understanding-malware.md).| +|5|Network protection |Your organization's security team can protect your network by blocking specific URLs and IP addresses. [Protect your network](../microsoft-defender-atp/network-protection.md).| +|6|File blocking |Your organization's security team can block specific files. [Stop and quarantine files in your network](../microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network).| +|7|Auditing events |Auditing event signals are available in [endpoint detection and response capabilities](../microsoft-defender-atp/overview-endpoint-detection-response.md). (These signals are not available with non-Microsoft antivirus solutions.) | +|8|Geographic data |Compliant with ISO 270001 and data retention, geographic data is provided according to your organization's selected geographic sovereignty. See [Compliance offerings: ISO/IEC 27001:2013 Information Security Management Standards](https://docs.microsoft.com/microsoft-365/compliance/offering-iso-27001). | +|9|File recovery via OneDrive |If you are using Windows Defender Antivirus together with [Office 365](https://docs.microsoft.com/Office365/Enterprise/), and your device is attacked by ransomware, your files are protected and recoverable. [OneDrive Files Restore and Windows Defender take ransomware protection one step further](https://techcommunity.microsoft.com/t5/Microsoft-OneDrive-Blog/OneDrive-Files-Restore-and-Windows-Defender-takes-ransomware/ba-p/188001).| +|10|Technical support |By using Microsoft Defender ATP together with Windows Defender Antivirus, you have one company to call for technical support. [Troubleshoot service issues](../microsoft-defender-atp/troubleshoot-mdatp.md) and [review event logs and error codes with Windows Defender Antivirus](troubleshoot-windows-defender-antivirus.md). | + ## Learn more From 0b25985d2d073e5f94e45c2a1f342817de80cedb Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 21 Dec 2019 13:56:30 +0500 Subject: [PATCH 035/335] Update windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../select-types-of-rules-to-create.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index f6ea23a20f..26bd6f527f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -67,7 +67,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| | **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | | **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | -| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by administrator) for the path pecified in the FilePathRule parameter of the New-CIPolicyRule cmdlet. | +| **18 Disabled:Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for the path specified in the FilePathRule parameter of the New-CIPolicyRule cmdlet. | | **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | ## Windows Defender Application Control file rule levels From 4e7d4af6b9f63a16770e483d71840f726b997b9a Mon Sep 17 00:00:00 2001 From: tiburd Date: Mon, 23 Dec 2019 13:43:59 -0800 Subject: [PATCH 036/335] edit pass: surface-hub-2s-recover-reset --- .../surface-hub-2s-recover-reset.md | 59 +++++++++++-------- 1 file changed, 34 insertions(+), 25 deletions(-) diff --git a/devices/surface-hub/surface-hub-2s-recover-reset.md b/devices/surface-hub/surface-hub-2s-recover-reset.md index 5c28202363..af763b9e26 100644 --- a/devices/surface-hub/surface-hub-2s-recover-reset.md +++ b/devices/surface-hub/surface-hub-2s-recover-reset.md @@ -15,46 +15,55 @@ ms.localizationpriority: Medium # Reset and recovery for Surface Hub 2S -If you encounter problems with Surface Hub 2S, you can reset the device to factory settings or recover using a USB drive. +If you encounter problems with Surface Hub 2S, you can reset the device to factory settings or restore by using a USB drive. -To begin, sign into Surface Hub 2S with admin credentials, open the **Settings** app, select **Update & security**, and then select **Recovery**. +To begin, sign in to Surface Hub 2S with admin credentials, open the **Settings** app, select **Update & security**, and then select **Recovery**. -## Reset device +## Reset the device -1. To reset, select **Get Started**. -2. When the **Ready to reset this device** window appears, select **Reset**. Surface Hub 2S reinstalls the operating system from the recovery partition and may take up to one hour to complete. -3. Run **the first time Setup program** to reconfigure the device. -4. If you manage the device using Intune or other mobile device manager (MDM) solution, retire and delete the previous record and re-enroll the new device. For more information, see [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe). +1. To reset the device, select **Get Started**. +2. When the **Ready to reset this device** window appears, select **Reset**. + >[!NOTE] + >Surface Hub 2S reinstalls the operating system from the recovery partition. This may take up to one hour to complete. +3. To reconfigure the device, run the first-time Setup program. +4. If you manage the device using Microsoft Intune or another mobile device management solution, retire and delete the previous record, and then re-enroll the new device. For more information, see [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe). ![*Reset and recovery for Surface Hub 2S*](images/sh2-reset.png)
-*Figure 1. Reset and recovery for Surface Hub 2S.* +*Figure 1. Reset and recovery for Surface Hub 2S* -## Recover Surface Hub 2S using USB recovery drive +## Recover Surface Hub 2S by using a USB recovery drive -New in Surface Hub 2S, you can now reinstall the device using a recovery image. +New in Surface Hub 2S, you can now reinstall the device by using a recovery image. -### Recover from USB drive +### Recovery from a USB drive -Surface Hub 2S lets you reinstall the device using a recovery image, which allows you to reinstall the device to factory settings if you lost the Bitlocker key or no longer have admin credentials to the Settings app. +Using Surface Hub 2S, you can reinstall the device by using a recovery image. By doing this, you can reinstall the device to the factory settings if you lost the BitLocker key, or if you no longer have admin credentials to the Settings app. -1. Begin with a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32. -2. From a separate PC, download the .zip file recovery image from the [Surface Recovery website](https://support.microsoft.com/surfacerecoveryimage?devicetype=surfacehub2s) and then return to these instructions. -3. Unzip the downloaded file onto the root of the USB drive. -4. Connect the USB drive to any USB-C or USB-A port on Surface Hub 2S. -5. Turn off the device. While holding down the Volume down button, press the Power button. Keep holding both buttons until you see the Windows logo. Release the Power button but continue to hold the Volume until the Install UI begins. +>[!NOTE] +>Use a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32. -![*Use Volume down and power buttons to initiate recovery*](images/sh2-keypad.png)
+1. From a separate PC, download the .zip file recovery image from the [Surface Recovery website](https://support.microsoft.com/surfacerecoveryimage?devicetype=surfacehub2s) and then return to these instructions. +1. Unzip the downloaded file onto the root of the USB drive. +1. Connect the USB drive to any USB-C or USB-A port on Surface Hub 2S. +1. Turn off the device: + 1. While holding down the Volume down button, press the Power button. + 1. Keep holding both buttons until you see the Windows logo. + 1. Release the Power button but continue to hold the Volume until the Install UI begins. -6. In the language selection screen, select the display language for your Surface Hub 2S. -7. Choose **Recover from a drive** and **Fully clean the drive** and then select **Recover**. If prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process. -Remove the USB drive when the first time setup screen appears. + ![*Use Volume down and power buttons to initiate recovery*](images/sh2-keypad.png)
+ **Figure 2. Volume and Power buttons** + +1. On the language selection screen, select the display language for your Surface Hub 2S. +1. Select **Recover from a drive** and **Fully clean the drive**, and then select **Recover**. If you're prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process. + +When the first-time setup screen appears,remove the USB drive. ## Recover a locked Surface Hub -On rare occasions, Surface Hub 2S may encounter an error during cleanup of user and app data at the end of a session. If this occurs, the device will automatically reboot and resume data cleanup. But if this operation fails repeatedly, the device will be automatically locked to protect user data. +At the end of a session, Surface Hub 2S may occasionally encounter an error during the cleanup of user and app data at the end of a session. If this occurs, the device automatically reboots and resumes the data cleanup. However, if this operation repeatedly fails, the device automatically locks to protect user data. -**To unlock Surface Hub 2S:**
-Reset or recover the device from Windows Recovery Environment (Windows RE). For more information, see [What is Windows RE?](https://technet.microsoft.com/library/cc765966.aspx) +**To unlock a Surface Hub 2S:**
+- Reset or recover the device from the Windows Recovery Environment. For more information, see [What is Windows RE?](https://technet.microsoft.com/library/cc765966.aspx) > [!NOTE] -> To enter recovery mode, you need to physically unplug and replug the power cord three times. +> To enter recovery mode, unplug the power cord and plug it in again three times. From 22da5b497b272b6c0dcd2fec92ef690d33f9c070 Mon Sep 17 00:00:00 2001 From: Joyce Y <47188252+mypil@users.noreply.github.com> Date: Tue, 24 Dec 2019 09:21:01 -0400 Subject: [PATCH 037/335] fixed typo in line 65 Resolves #5742 --- devices/hololens/hololens2-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md index 319644824d..79189a7cf6 100644 --- a/devices/hololens/hololens2-setup.md +++ b/devices/hololens/hololens2-setup.md @@ -62,7 +62,7 @@ To turn on your HoloLens 2, press the Power button. The LED lights below the Po | To turn on | Single button press. | All five lights turn on, then change to indicate the battery level. After four seconds, a sound plays. | | To sleep | Single button press. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." | | To wake from sleep | Single button press. | All five lights turn on, then change to indicate the battery level. A sound immediately plays. | -| To turn off | Press and for hold 5s. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." | +| To turn off | Press and hold for 5s. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." | | To force the Hololens to restart if it is unresponsive | Press and hold for 10s. | All five lights turn on, then fade off one at a time. After the lights turn off. | ## HoloLens behavior reference From af672cb9bd2184a9d03b202ee0f47f1efe0fff61 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Tue, 24 Dec 2019 23:42:47 +0530 Subject: [PATCH 038/335] added extra registry keys added extra registry keys taken reference from windows 10 1909 enterprise --- .../access-control/security-identifiers.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index f8a3185eb0..48c754cac7 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -289,6 +289,15 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. +## Example registry keys are taken from windows 10 1909 64bit Enterprise edition + You may see the following registry keys are under AllCachedCapabilities +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_General +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Restricted +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Windows + All Capability SIDs are prefixed by S-1-15-3 ## See also From e9eecda975434385cc560d4ffc32b5a8ab89b6cb Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 26 Dec 2019 08:31:23 +0530 Subject: [PATCH 039/335] Update windows/security/identity-protection/access-control/security-identifiers.md accepted Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/access-control/security-identifiers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index 48c754cac7..494ce08ce3 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -290,7 +290,8 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. ## Example registry keys are taken from windows 10 1909 64bit Enterprise edition - You may see the following registry keys are under AllCachedCapabilities +You may see the following registry keys under AllCachedCapabilities: + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise From 1de9b8809e2afa14b4f30a5ac233ec28cd3b37ef Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 26 Dec 2019 08:31:37 +0530 Subject: [PATCH 040/335] Update windows/security/identity-protection/access-control/security-identifiers.md accepted Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/access-control/security-identifiers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index 494ce08ce3..f2e08d21f5 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -289,7 +289,7 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. -## Example registry keys are taken from windows 10 1909 64bit Enterprise edition +## Example—registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition You may see the following registry keys under AllCachedCapabilities: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock From fe31b35f6cc3e0fb071ea8ab84f0c06e84c38731 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 26 Dec 2019 16:22:23 +0500 Subject: [PATCH 041/335] Update hello-hybrid-cert-whfb-settings-dir-sync.md --- .../hello-hybrid-cert-whfb-settings-dir-sync.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index e2d7d4fc9c..5e12221702 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -31,7 +31,7 @@ In hybrid deployments, users register the public portion of their Windows Hello The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use pre-created group KeyAdmins in step 3 of "Group Memberships for the Azure AD Connect Service Account" section of this article. ### Configure Permissions for Key Synchronization @@ -56,9 +56,6 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. - >[!IMPORTANT] - > If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. - 3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** 5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. From 1a6c5fb26245909bcf1fe22db0c414271b10c69e Mon Sep 17 00:00:00 2001 From: coffeemade <39417823+coffeemade@users.noreply.github.com> Date: Thu, 26 Dec 2019 14:21:03 -0500 Subject: [PATCH 042/335] modification of the importance to make it a bubble Sorry didn't see the code, so I changed it so that it will make a bubble instead of just important text. Hope this works. --- .../on-premises-deployment-surface-hub-device-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md index 7f3793ed3f..8043e93501 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md @@ -49,7 +49,7 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013 ```PowerShell New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String -AsPlainText -Force) ``` -[!IMPORTANT] ActiveSync Virtual Directory Basic Authentication is required to be enabled as the Surface Hub is unable to authenticate using other authentication methods. +> [!IMPORTANT] ActiveSync Virtual Directory Basic Authentication is required to be enabled as the Surface Hub is unable to authenticate using other authentication methods. 3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy. From 7074d6d509ab180f8468aab7f55222e5f57961b0 Mon Sep 17 00:00:00 2001 From: Chris Jackson Date: Thu, 26 Dec 2019 16:06:14 -0600 Subject: [PATCH 043/335] Update the group policy path The path in local group policy is now "Computer Configuration\Administrative Templates\System\Device Guard" (at least in 10.0.19041), updating docs to match what is in local group policy. --- .../audit-windows-defender-application-control-policies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 133cd1426f..8f28ada884 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -40,7 +40,7 @@ Before you begin this process, you need to create a WDAC policy binary file. If > > - An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it by using the Local Group Policy Editor. -3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard**, and then select **Deploy Windows Defender Application Control**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1. +3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Device Guard**, and then select **Deploy Windows Defender Application Control**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1. > [!Note] > From 29da149af497bad2915f28d4055df30b5dfab4d3 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 26 Dec 2019 16:31:11 -0800 Subject: [PATCH 044/335] Create troubleshoot-event-id-41-restart.md --- .../troubleshoot-event-id-41-restart.md | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 windows/client-management/troubleshoot-event-id-41-restart.md diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md new file mode 100644 index 0000000000..36f16e5e74 --- /dev/null +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -0,0 +1,116 @@ +--- +title: Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first" +description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue +author: Teresa-Motiv +ms.author: v-tea +ms.date: 12/26/2019 +ms.prod: W10 +ms.topic: article +ms.custom: +- CI 111437 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +keywords: +manager: kaushika + +--- + +# Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first" + +> **Home users** +> This article is intended for use by support agents and IT professionals. If you're looking for more information about blue screen error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). + +The preferred way to shut down Windows is to select **Start**, and then select an option to turn off or shut down the computer. Then the operating system closes all files and notifies the running services and applications so that they can write any data to disk and flush any caches. + +If your computer shuts down unexpectedly, Windows logs an event that resembles the following the next time the computer starts: + +> Event ID: 41 +> Description: The system has rebooted without cleanly shutting down first. + +This event indicates that something unexpected happened that prevented Windows from shutting down correctly. Causes for such a shutdown include an interruption in the power supply or a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and, if they are present, includes them in the event data of Event ID 41. + +## How to use Event ID 41 when troubleshooting an unexpected shutdown or restart + +By itself, Event ID 41 might not contain sufficient information to explicitly define what happened. Typically, you have to also consider what was happening at the time of the unexpected shutdown (for example, whether the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: + +- [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a bug check code +- [Scenario 2](#scen2): The computer restarts because you pressed and held the power button +- Scenario 3: The computer restarts randomly or becomes completely unresponsive, and Event ID 41 is missing or does not include error code information + +### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a bug check code + +When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of the additional event data. This information includes the Stop error code (also called a bug check code), as shown in the following example: + +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 +> SleepInProgress false +> PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) + +> [!NOTE] +> Event ID 41 includes the bug check code in decimal format. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To convert decimal to hexadecimal, follow these steps: +> +> 1. Select **Start**, and then type **calc** in the **Search** box. +> 1. In the Calculator window, select **View** > **Programmer**. +> 1. On the left side of calculator, make sure that **Dec** is selected. +> 1. Use the keyboard to enter the decimal value of the **BugcheckCode** parameter. +> 1. On the left side of the calculator, select **Hex**. +> The value that the calculator displays is now the hexadecimal code. +> +> In the case of the example event data in this article, "159" converts to 0x0000009f. When a BugcheckCode entry is converted to a hexadecimal format, it should have eight digits. For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. + +After you identify the hexadecimal value, use the following references to continue troubleshooting: + +- [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md). +- [Bug Check Code Reference](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2). This page lists links to documentation for different bug check codes. +- [How to Debug Kernel Mode Blue Screen Crashes (for beginners)](https://blogs.technet.microsoft.com/askcore/2008/10/31/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners/). + +### Scenario 2: The computer restarts because you pressed and held the power button + +Because this method of restarting the computer interferes with Windows shutdown operations, we recommend only using this method if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the resulting Event ID 41 includes a non-zero value for the PowerButtonTimestamp entry. + +For help with troubleshooting an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." + +For more information about a specific situation in which a computer may stop responding, see KB 974476, [The computer stops responding when an USB device resumes from the USB Selective Suspend state in Windows 7 or in Windows Server 2008 R2](https://support.microsoft.com/help/974476/the-computer-stops-responding-when-an-usb-device-resumes-from-the-usb). + +### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero + +This scenario includes the following circumstances: + +- You shut off power to an unresponsive computer, then start it again. + To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also called a hard hang). +- The computer restarts, but does not generate Event ID 41. +- The computer restarts and generates Event ID 41, but the **BugcheckCode** and **PowerButtonTimestamp** values are zero. + +In such cases, something prevents Windows from generating error codes or from writing error codes to disk. Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error. + +The information in Event ID 41 provides some indication of where to start checking for problems: + +- **Event ID 41 is missing or the bug check code is zero**. This behavior might indicate a power supply problem. If the power supply to a computer is interrupted, the computer might shut down without generating a Stop error. If it does generate a Stop error, it might not finish writing the error codes to disk. The next time the computer starts, it might not log Event ID 41, or if it does, the bug check code is zero. Conditions such as the following might be the cause: + - In the case of a portable computer, the battery was removed or completely drained. + - In the case of a desktop computer, the computer was unplugged or was subject to a power outage. + - The power supply might be underpowered or faulty. + +- **The PowerButtonTimestamp value is zero**. This behavior might result if you disconnected power to a computer that was not responding to input. Conditions such as the following might be the cause: + - A Windows process blocked write access to the disk, and you shut down the computer by pressing and holding the power button for at least four seconds. + - You disconnected power to an unresponsive computer. + +Typically, the symptoms that this scenario describes indicate a hardware problem. To help isolate the problem, do the following: + +- **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify whether the issue occurs when the system runs at the correct speed. +- **Check the memory**. Use a memory checker to verify the memory health and configuration. Verify that each memory chip is the same speed and that it is configured correctly in the system. +- **Check the power supply**. Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. +- **Overheating**. Examine the internal temperature of the hardware to verify that the system is not overheating. + +If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. + +> [!NOTE] +> If the computer reports a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. To do this, follow these steps: +> +> 1. Right-click **My Computer**, then select **Properties** > **Advanced system settings** > **Advanced**. +> 1. In the **Startup and Recovery** section, select **Settings**. +> 1. Clear the **Automatically restart** checkbox. From 79e763b13bb1ae57ea051245d5e5ca936cbbc148 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 26 Dec 2019 17:47:24 -0800 Subject: [PATCH 045/335] Metadata update, TOC edit --- windows/client-management/TOC.md | 1 + windows/client-management/troubleshoot-event-id-41-restart.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index 8da971ed53..cb93e0fb3b 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -31,5 +31,6 @@ #### [Advanced troubleshooting for Windows-based computer freeze](troubleshoot-windows-freeze.md) #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md) #### [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md) +#### [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) ## [Mobile device management for solution providers](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 36f16e5e74..7d3b955dcb 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -4,7 +4,7 @@ description: Describes the circumstances that cause a computer to generate Event author: Teresa-Motiv ms.author: v-tea ms.date: 12/26/2019 -ms.prod: W10 +ms.prod: w10 ms.topic: article ms.custom: - CI 111437 From 863411f8113a28fa8de8d30f41faa501a61f5bc6 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 26 Dec 2019 17:50:26 -0800 Subject: [PATCH 046/335] Added listing --- .../client-management/change-history-for-client-management.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 8eabad806b..adb273d21f 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -9,7 +9,7 @@ ms.pagetype: security ms.localizationpriority: medium author: dansimp ms.author: dansimp -ms.date: 12/13/2019 +ms.date: 12/27/2019 ms.reviewer: manager: dansimp ms.topic: article @@ -24,6 +24,7 @@ This topic lists new and updated topics in the [Client management](index.md) doc New or changed topic | Description --- | --- [Change in default removal policy for external storage media in Windows 10, version 1809](change-default-removal-policy-external-storage-media.md) | New +[Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) | New ## December 2018 From cc278df88d8b8153ad1c768304933e2a8bbb73bf Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Thu, 26 Dec 2019 17:57:36 -0800 Subject: [PATCH 047/335] Added link to new topic --- .../advanced-troubleshooting-boot-problems.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index a9442e6fe9..5986263a1e 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -220,7 +220,6 @@ If Windows cannot load the system registry hive into memory, you must restore th If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. - ## Kernel Phase If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following: @@ -228,8 +227,9 @@ If the system gets stuck during the kernel phase, you experience multiple sympto - A Stop error appears after the splash screen (Windows Logo screen). - Specific error code is displayed. - For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. - [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) + For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. + - [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) + - [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) - The screen is stuck at the "spinning wheel" (rolling dots) "system busy" icon. From b6ebf068a9d027aaf797196f8b6f3c2a077730c4 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 27 Dec 2019 08:18:23 +0530 Subject: [PATCH 048/335] Update windows/security/identity-protection/access-control/security-identifiers.md accepted Co-Authored-By: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../identity-protection/access-control/security-identifiers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index f2e08d21f5..c8bdc813a2 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -289,7 +289,7 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. -## Example—registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition +## Examples of registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition You may see the following registry keys under AllCachedCapabilities: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock From a1c7725897f0e7eaf1dacf6265593f0b9aabcfad Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Fri, 27 Dec 2019 14:48:26 +0200 Subject: [PATCH 049/335] add info about PA-PK-AS-REQ (16) https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5583 --- windows/security/threat-protection/auditing/event-4771.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md index 10876a5671..f97c972551 100644 --- a/windows/security/threat-protection/auditing/event-4771.md +++ b/windows/security/threat-protection/auditing/event-4771.md @@ -184,6 +184,7 @@ The most common values: | 2 | PA-ENC-TIMESTAMP | This is a normal type for standard password authentication. | | 11 | PA-ETYPE-INFO | The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value.
Never saw this Pre-Authentication Type in Microsoft Active Directory environment. | | 15 | PA-PK-AS-REP\_OLD | Used for Smart Card logon authentication. | +| 16 | PA-PK-AS-REQ | Request sent to KDC in Smart Card authentication scenarios.| | 17 | PA-PK-AS-REP | This type should also be used for Smart Card authentication, but in certain Active Directory environments, it is never seen. | | 19 | PA-ETYPE-INFO2 | The ETYPE-INFO2 pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value.
Never saw this Pre-Authentication Type in Microsoft Active Directory environment. | | 20 | PA-SVR-REFERRAL-INFO | Used in KDC Referrals tickets. | From 1aaff3631f82901a02ac158556c05eea63ae2de4 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 08:45:55 -0800 Subject: [PATCH 050/335] Link fix --- windows/client-management/troubleshoot-event-id-41-restart.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 7d3b955dcb..e6cb1aa7c9 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -36,7 +36,7 @@ By itself, Event ID 41 might not contain sufficient information to explicitly de - [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a bug check code - [Scenario 2](#scen2): The computer restarts because you pressed and held the power button -- Scenario 3: The computer restarts randomly or becomes completely unresponsive, and Event ID 41 is missing or does not include error code information +- [Scenario 3](#scen2): The computer restarts randomly or becomes completely unresponsive, and Event ID 41 is missing or does not include error code information ### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a bug check code @@ -77,7 +77,7 @@ For help with troubleshooting an unresponsive computer, see [Windows Help](https For more information about a specific situation in which a computer may stop responding, see KB 974476, [The computer stops responding when an USB device resumes from the USB Selective Suspend state in Windows 7 or in Windows Server 2008 R2](https://support.microsoft.com/help/974476/the-computer-stops-responding-when-an-usb-device-resumes-from-the-usb). -### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero +### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero This scenario includes the following circumstances: From f6faca985df4a7deb2085af580a5ae53be2d5cdc Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 08:49:01 -0800 Subject: [PATCH 051/335] Link fix --- windows/client-management/troubleshoot-event-id-41-restart.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index e6cb1aa7c9..ce4051c23d 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -36,7 +36,7 @@ By itself, Event ID 41 might not contain sufficient information to explicitly de - [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a bug check code - [Scenario 2](#scen2): The computer restarts because you pressed and held the power button -- [Scenario 3](#scen2): The computer restarts randomly or becomes completely unresponsive, and Event ID 41 is missing or does not include error code information +- [Scenario 3](#scen2): The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero ### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a bug check code From 7feda4b2d37c9b48bba7c289b710ad8a9421cb32 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 09:13:57 -0800 Subject: [PATCH 052/335] Edits --- .../troubleshoot-event-id-41-restart.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index ce4051c23d..b3cae5846a 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -30,6 +30,15 @@ If your computer shuts down unexpectedly, Windows logs an event that resembles t This event indicates that something unexpected happened that prevented Windows from shutting down correctly. Causes for such a shutdown include an interruption in the power supply or a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and, if they are present, includes them in the event data of Event ID 41. +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 +> SleepInProgress false +> PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) + ## How to use Event ID 41 when troubleshooting an unexpected shutdown or restart By itself, Event ID 41 might not contain sufficient information to explicitly define what happened. Typically, you have to also consider what was happening at the time of the unexpected shutdown (for example, whether the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: @@ -48,8 +57,6 @@ When a computer shuts down or restarts because of a Stop error, Windows includes > BugcheckParameter2 0xfffffa80029c5060 > BugcheckParameter3 0xfffff8000403d518 > BugcheckParameter4 0xfffffa800208c010 -> SleepInProgress false -> PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) > [!NOTE] > Event ID 41 includes the bug check code in decimal format. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To convert decimal to hexadecimal, follow these steps: From d0c92ecbeaf4ee9345e4e901cc2b2eea2f501f40 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 09:15:39 -0800 Subject: [PATCH 053/335] edits --- windows/client-management/troubleshoot-event-id-41-restart.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index b3cae5846a..01cf714e83 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -59,7 +59,7 @@ When a computer shuts down or restarts because of a Stop error, Windows includes > BugcheckParameter4 0xfffffa800208c010 > [!NOTE] -> Event ID 41 includes the bug check code in decimal format. Most documentation on Stop error codes reference the code as a hexadecimal value instead of a decimal value. To convert decimal to hexadecimal, follow these steps: +> Event ID 41 includes the bug check code in decimal format. Most documentation that describes Stop error codes refers the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: > > 1. Select **Start**, and then type **calc** in the **Search** box. > 1. In the Calculator window, select **View** > **Programmer**. From 436e1e451e68f0860215891437bd21a0a208b1ae Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 09:39:35 -0800 Subject: [PATCH 054/335] edits --- .../troubleshoot-event-id-41-restart.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 01cf714e83..6ebfafc0fd 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -61,14 +61,14 @@ When a computer shuts down or restarts because of a Stop error, Windows includes > [!NOTE] > Event ID 41 includes the bug check code in decimal format. Most documentation that describes Stop error codes refers the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: > -> 1. Select **Start**, and then type **calc** in the **Search** box. +> 1. Select **Start**, type **calc** in the **Search** box, and then select **Calculator**. > 1. In the Calculator window, select **View** > **Programmer**. -> 1. On the left side of calculator, make sure that **Dec** is selected. -> 1. Use the keyboard to enter the decimal value of the **BugcheckCode** parameter. +> 1. On the left side of calculator, make sure that **Dec** is highlighted. +> 1. Use the keyboard to enter the decimal value of the bug check code. > 1. On the left side of the calculator, select **Hex**. > The value that the calculator displays is now the hexadecimal code. > -> In the case of the example event data in this article, "159" converts to 0x0000009f. When a BugcheckCode entry is converted to a hexadecimal format, it should have eight digits. For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. +> When you convert a bug check code to hexadecimal format, make sure that it has eight digits (the value preceded by "0x" + enough zeros to fill out eight digits). For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. In the case of the example event data in this article, "159" converts to 0x0000009f. After you identify the hexadecimal value, use the following references to continue troubleshooting: @@ -78,7 +78,7 @@ After you identify the hexadecimal value, use the following references to contin ### Scenario 2: The computer restarts because you pressed and held the power button -Because this method of restarting the computer interferes with Windows shutdown operations, we recommend only using this method if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the resulting Event ID 41 includes a non-zero value for the PowerButtonTimestamp entry. +Because this method of restarting the computer interferes with Windows shutdown operations, we recommend only using this method if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the resulting Event ID 41 includes a non-zero value for the **PowerButtonTimestamp** entry. For help with troubleshooting an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." @@ -116,7 +116,7 @@ Typically, the symptoms that this scenario describes indicate a hardware problem If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. > [!NOTE] -> If the computer reports a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. To do this, follow these steps: +> If you see a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. To do this, follow these steps: > > 1. Right-click **My Computer**, then select **Properties** > **Advanced system settings** > **Advanced**. > 1. In the **Startup and Recovery** section, select **Settings**. From d9349086ba8b3d3ff3cdf29f3211c217a2d44d34 Mon Sep 17 00:00:00 2001 From: Teresa-Motiv Date: Fri, 27 Dec 2019 10:31:45 -0800 Subject: [PATCH 055/335] Edits --- .../troubleshoot-event-id-41-restart.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 6ebfafc0fd..ac4cc1afbc 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -3,7 +3,7 @@ title: Advanced troubleshooting for Event ID 41 "The system has rebooted without description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue author: Teresa-Motiv ms.author: v-tea -ms.date: 12/26/2019 +ms.date: 12/27/2019 ms.prod: w10 ms.topic: article ms.custom: @@ -11,7 +11,7 @@ ms.custom: - CSSTroubleshooting audience: ITPro ms.localizationpriority: medium -keywords: +keywords: event id 41, reboot, restart, stop error, bug check code manager: kaushika --- @@ -45,7 +45,7 @@ By itself, Event ID 41 might not contain sufficient information to explicitly de - [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a bug check code - [Scenario 2](#scen2): The computer restarts because you pressed and held the power button -- [Scenario 3](#scen2): The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero +- [Scenario 3](#scen3): The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero ### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a bug check code @@ -111,7 +111,7 @@ Typically, the symptoms that this scenario describes indicate a hardware problem - **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify whether the issue occurs when the system runs at the correct speed. - **Check the memory**. Use a memory checker to verify the memory health and configuration. Verify that each memory chip is the same speed and that it is configured correctly in the system. - **Check the power supply**. Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. -- **Overheating**. Examine the internal temperature of the hardware to verify that the system is not overheating. +- **Check for overheating**. Examine the internal temperature of the hardware to verify that the system is not overheating. If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. @@ -120,4 +120,4 @@ If you perform these checks and still cannot isolate the problem, set the system > > 1. Right-click **My Computer**, then select **Properties** > **Advanced system settings** > **Advanced**. > 1. In the **Startup and Recovery** section, select **Settings**. -> 1. Clear the **Automatically restart** checkbox. +> 1. Clear the **Automatically restart** check box. From c93e01abda1e75b4c300cb2881b5e8c6ecd6f04b Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 28 Dec 2019 08:56:36 +0500 Subject: [PATCH 056/335] Update windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-hybrid-cert-whfb-settings-dir-sync.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 5e12221702..16c17aa3f9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -31,7 +31,7 @@ In hybrid deployments, users register the public portion of their Windows Hello The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use pre-created group KeyAdmins in step 3 of "Group Memberships for the Azure AD Connect Service Account" section of this article. +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article. ### Configure Permissions for Key Synchronization From 12e44c25c647fcb2699ab06651f99f19502e8002 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 28 Dec 2019 22:34:27 +0530 Subject: [PATCH 057/335] removed the sentence which appeared twice as per user report #5756 , i removed the following sentence > [!NOTE] > A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]" --- devices/surface/surface-dock-firmware-update.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md index 104b12b126..751ea36a4d 100644 --- a/devices/surface/surface-dock-firmware-update.md +++ b/devices/surface/surface-dock-firmware-update.md @@ -50,9 +50,6 @@ You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firm > [!NOTE] > A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]" -> [!NOTE] -> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]" - For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation. > [!IMPORTANT] From 12a2f0c37afe1c7564772c7bacd69802e74ebf3b Mon Sep 17 00:00:00 2001 From: Mike Eggers <49650192+v-miegge@users.noreply.github.com> Date: Mon, 30 Dec 2019 10:01:15 -0800 Subject: [PATCH 058/335] Editing changes added v-miegge added editing changes from v-jesits. --- .../troubleshoot-event-id-41-restart.md | 62 +++++++++---------- 1 file changed, 30 insertions(+), 32 deletions(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index ac4cc1afbc..00344d5d62 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -19,16 +19,16 @@ manager: kaushika # Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first" > **Home users** -> This article is intended for use by support agents and IT professionals. If you're looking for more information about blue screen error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). +> This article is intended for use by support agents and IT professionals. If you're looking for more information about Stop code error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). -The preferred way to shut down Windows is to select **Start**, and then select an option to turn off or shut down the computer. Then the operating system closes all files and notifies the running services and applications so that they can write any data to disk and flush any caches. +The preferred way to shut down Windows is to select **Start**, and then select an option to turn off or shut down the computer. By using this standard method, the operating system closes all files and notifies the running services and applications so that they can write any unsaveddata to disk and flush any active caches. -If your computer shuts down unexpectedly, Windows logs an event that resembles the following the next time the computer starts: +If your computer shuts down unexpectedly, Windows logs Event ID 41 entry that resembles the following the next time that the computer starts: > Event ID: 41 > Description: The system has rebooted without cleanly shutting down first. -This event indicates that something unexpected happened that prevented Windows from shutting down correctly. Causes for such a shutdown include an interruption in the power supply or a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and, if they are present, includes them in the event data of Event ID 41. +This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown may be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and includes any existing codes in the event data of Event ID 41. > EventData > BugcheckCode 159 @@ -39,15 +39,15 @@ This event indicates that something unexpected happened that prevented Windows f > SleepInProgress false > PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) -## How to use Event ID 41 when troubleshooting an unexpected shutdown or restart +## How to use Event ID 41 when you troubleshoot an unexpected shutdown or restart -By itself, Event ID 41 might not contain sufficient information to explicitly define what happened. Typically, you have to also consider what was happening at the time of the unexpected shutdown (for example, whether the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: +By itself, Event ID 41 might not contain sufficient information to explicitly define what occured. Typically, you have to also consider what was occuring at the time of the unexpected shutdown (for example, the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: -- [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a bug check code +- [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code - [Scenario 2](#scen2): The computer restarts because you pressed and held the power button -- [Scenario 3](#scen3): The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero +- [Scenario 3](#scen3): The computer is unresponsive or randomly restarts, and Event ID 41 is not recorded or the Event ID 41 entry lists error code values of zero -### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a bug check code +### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error code When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of the additional event data. This information includes the Stop error code (also called a bug check code), as shown in the following example: @@ -59,59 +59,57 @@ When a computer shuts down or restarts because of a Stop error, Windows includes > BugcheckParameter4 0xfffffa800208c010 > [!NOTE] -> Event ID 41 includes the bug check code in decimal format. Most documentation that describes Stop error codes refers the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: +> Event ID 41 includes the bug check code in decimal format. Most documentation that describes Stop error codes refer to the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: > > 1. Select **Start**, type **calc** in the **Search** box, and then select **Calculator**. -> 1. In the Calculator window, select **View** > **Programmer**. -> 1. On the left side of calculator, make sure that **Dec** is highlighted. +> 1. In the **Calculator** window, select **View** > **Programmer**. +> 1. On the left side of calculator, verify that **Dec** is highlighted. > 1. Use the keyboard to enter the decimal value of the bug check code. > 1. On the left side of the calculator, select **Hex**. > The value that the calculator displays is now the hexadecimal code. > -> When you convert a bug check code to hexadecimal format, make sure that it has eight digits (the value preceded by "0x" + enough zeros to fill out eight digits). For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. In the case of the example event data in this article, "159" converts to 0x0000009f. +> When you convert a bug check code to hexadecimal format, verify that it has eight digits following the “0x” designation (that is, the part of the code after the “x” includes enough zeros to fill out eight digits). For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. In the case of the example event data in this article, "159" converts to 0x0000009f. After you identify the hexadecimal value, use the following references to continue troubleshooting: - [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md). -- [Bug Check Code Reference](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2). This page lists links to documentation for different bug check codes. +- [Bug Check Code Reference](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2). (This page lists links to documentation for different bug check codes.) - [How to Debug Kernel Mode Blue Screen Crashes (for beginners)](https://blogs.technet.microsoft.com/askcore/2008/10/31/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners/). ### Scenario 2: The computer restarts because you pressed and held the power button -Because this method of restarting the computer interferes with Windows shutdown operations, we recommend only using this method if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the resulting Event ID 41 includes a non-zero value for the **PowerButtonTimestamp** entry. +Because this method of restarting the computer interferes with the Windows shutdown operation, we recommend that you use this method only if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, Event ID 41 occurs and includes a non-zero value for the **PowerButtonTimestamp** entry. -For help with troubleshooting an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." +For help to troubleshoot an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." -For more information about a specific situation in which a computer may stop responding, see KB 974476, [The computer stops responding when an USB device resumes from the USB Selective Suspend state in Windows 7 or in Windows Server 2008 R2](https://support.microsoft.com/help/974476/the-computer-stops-responding-when-an-usb-device-resumes-from-the-usb). - -### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is missing or lists error code values of zero +### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is not recorded or the Event ID 41 entry or lists error code values of zero This scenario includes the following circumstances: -- You shut off power to an unresponsive computer, then start it again. - To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also called a hard hang). -- The computer restarts, but does not generate Event ID 41. +- You shut off power to an unresponsive computer, and then you restart the computer. + To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also known as a *hard hang*). +- The computer restarts, but it does not generate Event ID 41. - The computer restarts and generates Event ID 41, but the **BugcheckCode** and **PowerButtonTimestamp** values are zero. In such cases, something prevents Windows from generating error codes or from writing error codes to disk. Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error. The information in Event ID 41 provides some indication of where to start checking for problems: -- **Event ID 41 is missing or the bug check code is zero**. This behavior might indicate a power supply problem. If the power supply to a computer is interrupted, the computer might shut down without generating a Stop error. If it does generate a Stop error, it might not finish writing the error codes to disk. The next time the computer starts, it might not log Event ID 41, or if it does, the bug check code is zero. Conditions such as the following might be the cause: +- **Event ID 41 is not recorded or the bug check code is zero**. This behavior might indicate a power supply problem. If the power to a computer is interrupted, the computer might shut down without generating a Stop error. If it does generate a Stop error, it might not finish writing the error codes to disk. The next time the computer starts, it might not log Event ID 41. Or, if it does, the bug check code is zero. Conditions such as the following might be the cause: - In the case of a portable computer, the battery was removed or completely drained. - - In the case of a desktop computer, the computer was unplugged or was subject to a power outage. - - The power supply might be underpowered or faulty. + - In the case of a desktop computer, the computer was unplugged or experienced a power outage. + - The power supply is underpowered or faulty. -- **The PowerButtonTimestamp value is zero**. This behavior might result if you disconnected power to a computer that was not responding to input. Conditions such as the following might be the cause: +- **The PowerButtonTimestamp value is zero**. This behavior might occur if you disconnected the power to a computer that was not responding to input. Conditions such as the following might be the cause: - A Windows process blocked write access to the disk, and you shut down the computer by pressing and holding the power button for at least four seconds. - - You disconnected power to an unresponsive computer. + - You disconnected the power to an unresponsive computer. -Typically, the symptoms that this scenario describes indicate a hardware problem. To help isolate the problem, do the following: +Typically, the symptoms described in this scenario indicate a hardware problem. To help isolate the problem, do the following: -- **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify whether the issue occurs when the system runs at the correct speed. -- **Check the memory**. Use a memory checker to verify the memory health and configuration. Verify that each memory chip is the same speed and that it is configured correctly in the system. -- **Check the power supply**. Make sure that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. -- **Check for overheating**. Examine the internal temperature of the hardware to verify that the system is not overheating. +- **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify that the issue occurs when the system runs at the correct speed. +- **Check the memory**. Use a memory checker to determine the memory health and configuration. Verify that all memory chips run at the same speed and that every chip is configured correctly in the system. +- **Check the power supply**. Verify that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because the power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. +- **Check for overheating**. Examine the internal temperature of the hardware and check for any overheating components. If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. From 160e1b46f14ca5e48e9dababb2824a20e76aac9d Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Mon, 30 Dec 2019 20:17:27 +0200 Subject: [PATCH 059/335] add updated screenshot and remove outdated infos https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5634 --- ...our-free-azure-active-directory-subscription.md | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index 0f8b376074..ebf0cab962 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -29,21 +29,11 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent ![register azuread](images/azure-ad-add-tenant11.png) -3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. +3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![register azuread](images/azure-ad-add-tenant12.png) + ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) -4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread](images/azure-ad-add-tenant13.png) - -5. It may take a few minutes to process the request. - - ![register azuread](images/azure-ad-add-tenant14.png) - -6. You will see a welcome page when the process completes. - - ![register azuread](images/azure-ad-add-tenant15.png)   From 01becd9a16a75a2ab5da6208c265392c1db2629c Mon Sep 17 00:00:00 2001 From: Mike Eggers <49650192+v-miegge@users.noreply.github.com> Date: Mon, 30 Dec 2019 11:10:19 -0800 Subject: [PATCH 060/335] Edit to title --- windows/client-management/troubleshoot-event-id-41-restart.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index 00344d5d62..c982cc7835 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -1,5 +1,5 @@ --- -title: Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first" +title: Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue author: Teresa-Motiv ms.author: v-tea From 0a7c062cad44e932bcb549054790751c48b01e4f Mon Sep 17 00:00:00 2001 From: Mike Eggers <49650192+v-miegge@users.noreply.github.com> Date: Mon, 30 Dec 2019 11:11:33 -0800 Subject: [PATCH 061/335] Update troubleshoot-event-id-41-restart.md --- windows/client-management/troubleshoot-event-id-41-restart.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md index c982cc7835..3fbd3307c6 100644 --- a/windows/client-management/troubleshoot-event-id-41-restart.md +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -16,7 +16,7 @@ manager: kaushika --- -# Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first" +# Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" > **Home users** > This article is intended for use by support agents and IT professionals. If you're looking for more information about Stop code error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). From c9ec0d1b87ac46e03f8c04526ec7497611613ab7 Mon Sep 17 00:00:00 2001 From: scooley Date: Mon, 30 Dec 2019 18:04:52 -0800 Subject: [PATCH 062/335] updating find and save files --- .openpublishing.redirection.json | 5 + devices/hololens/TOC.md | 2 +- .../holographic-find-and-save-files.md | 99 +++++++++++++++++++ .../hololens/hololens-find-and-save-files.md | 66 ------------- 4 files changed, 105 insertions(+), 67 deletions(-) create mode 100644 devices/hololens/holographic-find-and-save-files.md delete mode 100644 devices/hololens/hololens-find-and-save-files.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 551ce8b897..eb504664d5 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -45,6 +45,11 @@ "redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker", "redirect_document_id": false }, +{ + "source_path": "devices/hololens/hololens-find-and-save-files.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-find-and-save-files", + "redirect_document_id": false +}, { "source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md", "redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index ce3a2dd2a0..64b09299cd 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -28,7 +28,7 @@ # Navigating Windows Holographic ## [Start menu and mixed reality home](holographic-home.md) ## [Use your voice with HoloLens](hololens-cortana.md) -## [Find and save files](hololens-find-and-save-files.md) +## [Find and save files](holographic-find-and-save-files.md) ## [Create, share, and view photos and video](holographic-photos-and-videos.md) # User management and access management diff --git a/devices/hololens/holographic-find-and-save-files.md b/devices/hololens/holographic-find-and-save-files.md new file mode 100644 index 0000000000..155b32e885 --- /dev/null +++ b/devices/hololens/holographic-find-and-save-files.md @@ -0,0 +1,99 @@ +--- +title: Find and save files on HoloLens +description: Use File Explorer on HoloLens to view and manage files on your device +keywords: how-to, file picker, files, photos, videos, pictures, OneDrive, storage, file explorer +ms.assetid: 77d2e357-f65f-43c8-b62f-6cd9bf37070a +author: mattzmsft +ms.author: mazeller +manager: v-miegge +ms.reviewer: jarrettrenshaw +ms.date: 12/30/2019 +keywords: hololens +ms.prod: hololens +ms.sitesec: library +ms.topic: article +ms.localizationpriority: medium +appliesto: +- HoloLens (1st gen) +- HoloLens 2 +--- + +# Find, open, and save files on HoloLens + +Files you create on HoloLens, including photos and videos, are saved directly to your HoloLens device. View and manage them in the same way you would manage files on Windows 10: + +- Using the File Explorer app to access local folders. +- Within an app's storage. +- In a special folder (such as the video or music library). +- Using a storage service that includes an app and file picker (such as OneDrive). +- Using a desktop PC connected to your HoloLens by using a USB cable, using MTP (Media Transfer Protocol) support. + +## View files on HoloLens using File Explorer + +> Applies to all HoloLens 2 devices and HoloLens (1st gen) as of the [Windows 10 April 2018 Update (RS4) for HoloLens](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018). + +Use File Explorer on HoloLens to view and manage files on your device, including 3D objects, documents, and pictures. Go to **Start** > **All apps** > **File Explorer** to get started. + +> [!TIP] +> If there are no files listed in File Explorer, select **This Device** in the top left pane. + +If you don’t see any files in File Explorer, the "Recent" filter may be active (clock icon is highlighted in left pane). To fix this, select the **This Device** document icon in the left pane (beneath the clock icon), or open the menu and select **This Device**. + +## Find and view your photos and videos + +[Mixed reality capture](holographic-photos-and-videos.md) lets you take mixed reality photos and videos on HoloLens. These photos and videos are saved to the device's Camera Roll folder. + +You can access photos and videos taken with HoloLens by: + +- accessing the Camera Roll directly through the [Photos app](hololens-see-your-photos.md#photos-app). +- uploading photos and videos to cloud storage by syncing your photos and videos to OneDrive. +- using the Mixed Reality Capture page of the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture). + +### Photos app + +The Photos app is one of the default apps on the **Start** menu, and comes built-in with HoloLens. You can learn more about using the Photos app to view content and place it in your physical environment [on the HoloLens support site](https://docs.microsoft.com/en-us/hololens/). + +You can also install the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store to sync photos to other devices. + +### OneDrive app + +[OneDrive](https://onedrive.live.com/) lets you access, manage, and share your photos and videos with any device and with any user. To access the photos and videos captured on HoloLens, download the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store on your HoloLens. Once downloaded, open the OneDrive app and select **Settings** > **Camera upload**, and turn on **Camera upload**. + +### Connect to a PC + +If your HoloLens is running the [Windows 10 April 2018 update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) or later, you can connect your HoloLens to a Windows 10 PC by using a USB cable to browse photos and videos on the device by using MTP (media transfer protocol). You'll need to make sure the device is unlocked to browse files if you have a PIN or password set up on your device. + +If you have enabled the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal.md#mixed-reality-capture), you can use it to browse, retrieve, and manage the photos and videos stored on your device. + +## Access files within an app + +If an application saves files on your device, you can use that application to access them. + +### Requesting files from another app + +An application can request to save a file or open a file from another app by using [file pickers](https://docs.microsoft.com/windows/mixed-reality/app-model#file-pickers). + +### Known folders + +HoloLens supports a number of [known folders](https://docs.microsoft.com/windows/mixed-reality/app-model#known-folders) that apps can request permission to access. + +## View HoloLens files on your PC + +Similar to other mobile devices, connect HoloLens to your desktop PC using MTP (Media Transfer Protocol) and open File Explorer on the PC to access your HoloLens libraries for easy transfer. + +To see your HoloLens files in File Explorer on your PC: + +1. Sign in to HoloLens, then plug it into the PC using the USB cable that came with the HoloLens. + +1. Select **Open Device to view files with File Explorer**, or open File Explorer on the PC and navigate to the device. + +To see info about your HoloLens, right-click the device name in File Explorer on your PC, then select **Properties**. + +> [!NOTE] +> HoloLens (1st gen) does not support connecting to external hard drives or SD cards. + +## Sync to the cloud + +To sync photos and other files from your HoloLens to the cloud, install and set up OneDrive on HoloLens. To get OneDrive, search for it in the Microsoft Store on your HoloLens. + +HoloLens doesn't back up app files and data, so it's a good idea to save your important stuff to OneDrive. That way, if you reset your device or uninstall an app, your info will be backed up. diff --git a/devices/hololens/hololens-find-and-save-files.md b/devices/hololens/hololens-find-and-save-files.md deleted file mode 100644 index 19f153d785..0000000000 --- a/devices/hololens/hololens-find-and-save-files.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: Find and save files on HoloLens -description: Use File Explorer on HoloLens to view and manage files on your device -ms.assetid: 77d2e357-f65f-43c8-b62f-6cd9bf37070a -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge -keywords: hololens -ms.prod: hololens -ms.sitesec: library -author: v-miegge -ms.author: v-miegge -ms.topic: article -ms.localizationpriority: medium -appliesto: -- HoloLens (1st gen) -- HoloLens 2 ---- - -# Find and save files on HoloLens - -Add content from [Find and save files](https://docs.microsoft.com/windows/mixed-reality/saving-and-finding-your-files) - - -Files you create on HoloLens, including Office documents, photos, and videos, are saved to your HoloLens. To view and manage them, you can use the File Explorer app on HoloLens or File Explorer on your PC. To sync photos and other files to the cloud, use the OneDrive app on HoloLens. - -## View files on HoloLens - -Use File Explorer on HoloLens to view and manage files on your device, including 3D objects, documents, and pictures. Go to Start > All apps > File Explorer on HoloLens to get started. - ->[!TIP] ->If there are no files listed in File Explorer, select **This Device** in the top left pane. - -## View HoloLens files on your PC - -To see your HoloLens files in File Explorer on your PC: - -1. Sign in to HoloLens, then plug it into the PC using the USB cable that came with the HoloLens. - -1. Select **Open Device to view files with File Explorer**, or open File Explorer on the PC and navigate to the device. - ->[!TIP] ->To see info about your HoloLens, right-click the device name in File Explorer on your PC, then select **Properties**. - -## View HoloLens files on Windows Device Portal - ->[!NOTE] ->To use Device Portal you must enable [Developer Mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#setting-up-hololens-to-use-windows-device-portal). - -1. Enable Developer Mode and Device Portal on your HoloLens. (See note above if not enabled.) - -1. Navigate to the Device Portal page on your PC. - 1. To connect to a HoloLens connected to your PC type in 127.0.0.1:10080/ in your browser. - 1. To connect to a HoloLens wirelessly instead navigate to your IP address. - ->[!TIP] ->You may need to install a certificate, OR you may see more details and navigate to the website anyways. (Path per web broswer will differ.) - -1. Once succesfully connected, on the left side of the windw you can navigate to the [File Explorer](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#file-explorer) workspace. - -## Sync to the cloud - -To sync photos and other files from your HoloLens to the cloud, install and set up OneDrive on HoloLens. To get OneDrive, search for it in the Microsoft Store on your HoloLens. - ->[!TIP] ->HoloLens doesn't back up app files and data, so it's a good idea to save your important stuff to OneDrive. That way, if you reset your device or uninstall an app, your info will be backed up. From 99bef575e98431f604a49fd4a0165bfa8d463b23 Mon Sep 17 00:00:00 2001 From: Sarah Cooley Date: Mon, 30 Dec 2019 18:26:10 -0800 Subject: [PATCH 063/335] Link fixes --- devices/hololens/holographic-find-and-save-files.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/holographic-find-and-save-files.md b/devices/hololens/holographic-find-and-save-files.md index 155b32e885..da2d01c1e8 100644 --- a/devices/hololens/holographic-find-and-save-files.md +++ b/devices/hololens/holographic-find-and-save-files.md @@ -45,13 +45,13 @@ If you don’t see any files in File Explorer, the "Recent" filter may be active You can access photos and videos taken with HoloLens by: -- accessing the Camera Roll directly through the [Photos app](hololens-see-your-photos.md#photos-app). +- accessing the Camera Roll directly through the [Photos app](holographic-photos-and-videos.md). - uploading photos and videos to cloud storage by syncing your photos and videos to OneDrive. - using the Mixed Reality Capture page of the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture). ### Photos app -The Photos app is one of the default apps on the **Start** menu, and comes built-in with HoloLens. You can learn more about using the Photos app to view content and place it in your physical environment [on the HoloLens support site](https://docs.microsoft.com/en-us/hololens/). +The Photos app is one of the default apps on the **Start** menu, and comes built-in with HoloLens. Learn more about [using the Photos app to view content](holographic-photos-and-videos.md). You can also install the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store to sync photos to other devices. From aa375560be9aece2ec248644cc335bbcf9280dae Mon Sep 17 00:00:00 2001 From: scooley Date: Tue, 31 Dec 2019 13:38:48 -0800 Subject: [PATCH 064/335] fixing things per signoff criteria --- .openpublishing.redirection.json | 2 +- ...{holographic-find-and-save-files.md => holographic-data.md} | 3 ++- devices/hololens/hololens-FAQ.md | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) rename devices/hololens/{holographic-find-and-save-files.md => holographic-data.md} (97%) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index eb504664d5..e661551810 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -47,7 +47,7 @@ }, { "source_path": "devices/hololens/hololens-find-and-save-files.md", - "redirect_url": "https://docs.microsoft.com/hololens/holographic-find-and-save-files", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-data", "redirect_document_id": false }, { diff --git a/devices/hololens/holographic-find-and-save-files.md b/devices/hololens/holographic-data.md similarity index 97% rename from devices/hololens/holographic-find-and-save-files.md rename to devices/hololens/holographic-data.md index da2d01c1e8..2c2764a7c2 100644 --- a/devices/hololens/holographic-find-and-save-files.md +++ b/devices/hololens/holographic-data.md @@ -12,6 +12,7 @@ keywords: hololens ms.prod: hololens ms.sitesec: library ms.topic: article +audience: ITPro ms.localizationpriority: medium appliesto: - HoloLens (1st gen) @@ -63,7 +64,7 @@ You can also install the [OneDrive app](https://www.microsoft.com/p/onedrive/9wz If your HoloLens is running the [Windows 10 April 2018 update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) or later, you can connect your HoloLens to a Windows 10 PC by using a USB cable to browse photos and videos on the device by using MTP (media transfer protocol). You'll need to make sure the device is unlocked to browse files if you have a PIN or password set up on your device. -If you have enabled the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal.md#mixed-reality-capture), you can use it to browse, retrieve, and manage the photos and videos stored on your device. +If you have enabled the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal), you can use it to browse, retrieve, and manage the photos and videos stored on your device. ## Access files within an app diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md index 203d5185f8..432a1ab738 100644 --- a/devices/hololens/hololens-FAQ.md +++ b/devices/hololens/hololens-FAQ.md @@ -137,7 +137,7 @@ Try walking around and looking at the area where you're placing the app so HoloL Free up some storage space by doing one or more of the following: -- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](hololens-find-and-save-files.md) +- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](hololgraphic-data.md) - Delete some pictures and videos in the Photos app. - Uninstall some apps from your HoloLens. In the All apps list, tap and hold the app you want to uninstall, then select **Uninstall**. (This will also delete any of the app's data stored on the device.) From e7e41d0837adf60671ee9e8e61871df8e077b930 Mon Sep 17 00:00:00 2001 From: scooley Date: Tue, 31 Dec 2019 13:49:11 -0800 Subject: [PATCH 065/335] forgot some links --- devices/hololens/TOC.md | 2 +- devices/hololens/holographic-data.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index 64b09299cd..6ed8d59688 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -28,7 +28,7 @@ # Navigating Windows Holographic ## [Start menu and mixed reality home](holographic-home.md) ## [Use your voice with HoloLens](hololens-cortana.md) -## [Find and save files](holographic-find-and-save-files.md) +## [Find and save files](holographic-data.md) ## [Create, share, and view photos and video](holographic-photos-and-videos.md) # User management and access management diff --git a/devices/hololens/holographic-data.md b/devices/hololens/holographic-data.md index 2c2764a7c2..1f28c4fac9 100644 --- a/devices/hololens/holographic-data.md +++ b/devices/hololens/holographic-data.md @@ -12,7 +12,7 @@ keywords: hololens ms.prod: hololens ms.sitesec: library ms.topic: article -audience: ITPro +audience: ITPro ms.localizationpriority: medium appliesto: - HoloLens (1st gen) From 8647d6be30bcd2a7eab65b7f3a8f97975e773972 Mon Sep 17 00:00:00 2001 From: scooley Date: Tue, 31 Dec 2019 14:00:29 -0800 Subject: [PATCH 066/335] typo --- devices/hololens/hololens-FAQ.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md index 432a1ab738..a183165e4a 100644 --- a/devices/hololens/hololens-FAQ.md +++ b/devices/hololens/hololens-FAQ.md @@ -137,7 +137,7 @@ Try walking around and looking at the area where you're placing the app so HoloL Free up some storage space by doing one or more of the following: -- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](hololgraphic-data.md) +- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](holographic-data.md) - Delete some pictures and videos in the Photos app. - Uninstall some apps from your HoloLens. In the All apps list, tap and hold the app you want to uninstall, then select **Uninstall**. (This will also delete any of the app's data stored on the device.) From efdc2f11eca802a04e197fc49942a2bfe03fad03 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 1 Jan 2020 16:00:38 +0500 Subject: [PATCH 067/335] Policy location mentioned Policy location mentioned as it was missing. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5737 --- .../interactive-logon-machine-inactivity-limit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md index b836aabd10..3017775493 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md @@ -26,7 +26,7 @@ Describes the best practices, location, values, management, and security conside ## Reference -Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine). This policy setting allows you to control the locking time by using Group Policy. +Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine. You can activate screen saver by enableing Group Policy at User Configuration\Administrative Templates\Control Panel\Personalization\ "Enable screen saver"). This policy setting allows you to control the locking time by using Group Policy. ### Possible values From 1c47e4d5d3c31a1edc7d8be5a8a3d68b7fcc9abd Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 1 Jan 2020 16:38:01 +0500 Subject: [PATCH 068/335] Update windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../interactive-logon-machine-inactivity-limit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md index 3017775493..c519e01af5 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md @@ -26,7 +26,7 @@ Describes the best practices, location, values, management, and security conside ## Reference -Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine. You can activate screen saver by enableing Group Policy at User Configuration\Administrative Templates\Control Panel\Personalization\ "Enable screen saver"). This policy setting allows you to control the locking time by using Group Policy. +Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine. You can activate the screen saver by enabling the Group Policy **User Configuration\Administrative Templates\Control Panel\Personalization\Enable screen saver**). This policy setting allows you to control the locking time by using Group Policy. ### Possible values From 215b1a5009872dba78db67f616c1d6e9aa7d5f7d Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 1 Jan 2020 16:41:29 +0500 Subject: [PATCH 069/335] Minor changes in heading Minor changes in heading as this should go with key trust deployment guide. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5695 --- .../hello-for-business/hello-key-trust-validate-pki.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 5f6fb9480c..2a02be9899 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -196,7 +196,7 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. -## Follow the Windows Hello for Business on premises certificate trust deployment guide +## Follow the Windows Hello for Business on premises certificate key trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. Validate and Configure Public Key Infrastructure (*You are here*) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) From 5902465ca31c03a296b1f728d91922ae6b503357 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 1 Jan 2020 22:53:35 +0500 Subject: [PATCH 070/335] minor correction in text As suggested by user, I have made correction in the text. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5701 --- devices/surface-hub/surface-hub-2s-account.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md index 3312d5f4ec..fb93b0e7d9 100644 --- a/devices/surface-hub/surface-hub-2s-account.md +++ b/devices/surface-hub/surface-hub-2s-account.md @@ -47,7 +47,7 @@ Create the account using the Microsoft 365 admin center or by using PowerShell. - **Skype for Business:** For Skype for Business only (on-premises or online), you can enable the Skype for Business object by running **Enable-CsMeetingRoom** to enable features such as Meeting room prompt for audio and Lobby hold. -- **Calendar:** Set **Calendar Auto processing** for this account. +- **Microsoft Teams and Skype for Business Calendar:** Set [**Calendar Auto processing**](https://docs.microsoft.com/surface-hub/surface-hub-2s-account?source=docs#set-calendar-auto-processing) for this account. ## Create account using PowerShell Instead of using the Microsoft Admin Center portal, you can create the account using PowerShell. From c830345abd3923fde12248cb8806ca48e9f95663 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 1 Jan 2020 23:33:02 +0500 Subject: [PATCH 071/335] Output was Wrong it should be 0 if the device is not yet onboarded. Made the correction. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5708 --- .../microsoft-defender-atp/mac-install-with-jamf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md index 259e8692cd..083d1a181e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf.md @@ -225,7 +225,7 @@ $ mdatp --health healthy The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 1 if the device is not yet onboarded +- 0 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running ## Logging installation issues From f9899bb995120db3686b91230a344307d5ae27e9 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 2 Jan 2020 13:22:15 +0500 Subject: [PATCH 072/335] Data clearance As mentioned by user, made some changes in the table to reflect the correct information Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/5706#issuecomment-570097021 --- windows/security/threat-protection/auditing/event-4912.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4912.md b/windows/security/threat-protection/auditing/event-4912.md index 06ffbee5b0..4e98d50f44 100644 --- a/windows/security/threat-protection/auditing/event-4912.md +++ b/windows/security/threat-protection/auditing/event-4912.md @@ -126,8 +126,9 @@ This event is always logged regardless of the "Audit Policy Change" sub-category - **Subcategory** \[Type = UnicodeString\]**:** the name of auditing subcategory which state was changed. Possible values: -| Audit Credential Validation | Audit Process Termination | Audit Other Logon/Logoff Events | +| Value | Value | Value | |------------------------------------------|----------------------------------------------|--------------------------------------| +| Audit Credential Validation | Audit Process Termination | Audit Other Logon/Logoff Events | | Audit Kerberos Authentication Service | Audit RPC Events | Audit Special Logon | | Audit Kerberos Service Ticket Operations | Audit Detailed Directory Service Replication | Audit Application Generated | | Audit Other Logon/Logoff Events | Audit Directory Service Access | Audit Certification Services | @@ -145,7 +146,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category | Audit Policy Change | Audit Non-Sensitive Privilege Use | Audit System Integrity | | Audit Authentication Policy Change | Audit Sensitive Privilege Use | Audit PNP Activity | | Audit Authorization Policy Change | Audit Other Privilege Use Events | | -| Group Membership | Audit Network Policy Server | | +| Audit Group Membership | Audit Network Policy Server | | - **Subcategory GUID** \[Type = GUID\]**:** the unique GUID of changed subcategory. From feba3cbaba71ef15272f9ca6e5245853b4541e4c Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 2 Jan 2020 13:26:41 +0500 Subject: [PATCH 073/335] Update windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md Co-Authored-By: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../interactive-logon-machine-inactivity-limit.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md index c519e01af5..accf7f1ab2 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md @@ -26,7 +26,7 @@ Describes the best practices, location, values, management, and security conside ## Reference -Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine. You can activate the screen saver by enabling the Group Policy **User Configuration\Administrative Templates\Control Panel\Personalization\Enable screen saver**). This policy setting allows you to control the locking time by using Group Policy. +Beginning with Windows Server 2012 and Windows 8, Windows detects user-input inactivity of a sign-in (logon) session by using the security policy setting **Interactive logon: Machine inactivity limit**. If the amount of inactive time exceeds the inactivity limit set by this policy, then the user’s session locks by invoking the screen saver (screen saver should be active on the destination machine). You can activate the screen saver by enabling the Group Policy **User Configuration\Administrative Templates\Control Panel\Personalization\Enable screen saver**. This policy setting allows you to control the locking time by using Group Policy. ### Possible values From 5ed4a24514370f95da413f0cfbb748b7111f9e7b Mon Sep 17 00:00:00 2001 From: martyav Date: Thu, 2 Jan 2020 12:19:07 -0500 Subject: [PATCH 074/335] items through 194 reviewed --- .../deployment/planning/sua-users-guide.md | 139 ++--- .../using-the-sdbinstexe-command-line-tool.md | 227 +++---- .../volume-activation-management-tool.md | 87 +-- .../windows-10-deployment-scenarios.md | 552 +++++++++--------- .../credential-guard-manage.md | 2 +- .../hello-biometrics-in-enterprise.md | 2 +- .../auditing/audit-file-system.md | 2 +- .../auditing/audit-handle-manipulation.md | 2 +- .../auditing/audit-ipsec-quick-mode.md | 2 +- .../auditing/audit-logoff.md | 2 +- .../audit-other-object-access-events.md | 2 +- .../monitor-resource-attribute-definitions.md | 2 +- ...or-the-use-of-removable-storage-devices.md | 2 +- ...r-user-and-device-claims-during-sign-in.md | 2 +- ...icrosoft-cloud-app-security-integration.md | 2 +- .../tvm-dashboard-insights.md | 2 +- .../tvm-exposure-score.md | 2 +- ...-log-on-through-remote-desktop-services.md | 2 +- ...rypt-or-sign-secure-channel-data-always.md | 2 +- ...crypt-secure-channel-data-when-possible.md | 2 +- ...ge-title-for-users-attempting-to-log-on.md | 2 +- ...ctive-logon-smart-card-removal-behavior.md | 2 +- ...server-spn-target-name-validation-level.md | 2 +- ...udit-ntlm-authentication-in-this-domain.md | 2 +- ...le-allow-automatic-administrative-logon.md | 2 +- 25 files changed, 526 insertions(+), 521 deletions(-) diff --git a/windows/deployment/planning/sua-users-guide.md b/windows/deployment/planning/sua-users-guide.md index e0adb30d1a..56143ee843 100644 --- a/windows/deployment/planning/sua-users-guide.md +++ b/windows/deployment/planning/sua-users-guide.md @@ -1,69 +1,70 @@ ---- -title: SUA User's Guide (Windows 10) -description: You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. -ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# SUA User's Guide - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 -- Windows Server 2008 R2 - -You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. - -You can use SUA in either of the following ways: - -- **Standard User Analyzer Wizard.** A wizard that guides you through a step-by-step process to locate and fix issues, without options for additional analysis. - -- **Standard User Analyzer Tool.** A full-function tool in which you can perform in-depth analysis and fix issues. - -## In this section - - - ---- - - - - - - - - - - - - - - - - -
TopicDescription

Using the SUA Wizard

The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.

Using the SUA Tool

By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.

- - - - - - - - +--- +title: SUA User's Guide (Windows 10) +description: Standard User Analyzer (SUA) can test your apps and monitor API calls to detect compatibility issues related to Windows' User Account Control (UAC) feature. +ms.assetid: ea525c25-b557-4ed4-b042-3e4d0e543e10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# SUA User's Guide + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 +- Windows Server 2008 R2 + +You can use Standard User Analyzer (SUA) to test your applications and monitor API calls to detect compatibility issues related to the User Account Control (UAC) feature in Windows. + +You can use SUA in either of the following ways: + +- **Standard User Analyzer Wizard.** A wizard that guides you through a step-by-step process to locate and fix issues, without options for additional analysis. + +- **Standard User Analyzer Tool.** A full-function tool in which you can perform in-depth analysis and fix issues. + +## In this section + + + ++++ + + + + + + + + + + + + + + + + +
TopicDescription

Using the SUA Wizard

The Standard User Analyzer (SUA) Wizard works much like the SUA tool to evaluate User Account Control (UAC) issues. However, the SUA Wizard does not offer detailed analysis, and it cannot disable virtualization or elevate your permissions.

Using the SUA Tool

By using the Standard User Analyzer (SUA) tool, you can test your applications and monitor API calls to detect compatibility issues with the User Account Control (UAC) feature.

+ + + + + + + + diff --git a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md index eb092034f3..649a832f90 100644 --- a/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md +++ b/windows/deployment/planning/using-the-sdbinstexe-command-line-tool.md @@ -1,113 +1,114 @@ ---- -title: Using the Sdbinst.exe Command-Line Tool (Windows 10) -description: You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. -ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: plan -ms.pagetype: appcompat -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Using the Sdbinst.exe Command-Line Tool - - -**Applies to** - -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2016 -- Windows Server 2012 -- Windows Server 2008 R2 - -You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations. - -After you deploy and store the customized databases on each of your local computers, you must register the database files. Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application. - -## Command-Line Options for Deploying Customized Database Files - -Sample output from the command `Sdbinst.exe /?` in an elevated CMD window: - -``` -Microsoft Windows [Version 10.0.14393] -(c) 2016 Microsoft Corporation. All rights reserved. - -C:\Windows\system32>Sdbinst.exe /? -Usage: Sdbinst.exe [-?] [-q] [-u] [-g] [-p] [-n[:WIN32|WIN64]] myfile.sdb | {guid} | "name" - - -? - print this help text. - -p - Allow SDBs containing patches. - -q - Quiet mode: prompts are auto-accepted. - -u - Uninstall. - -g {guid} - GUID of file (uninstall only). - -n "name" - Internal name of file (uninstall only). - -C:\Windows\system32>_ -``` - -The command-line options use the following conventions: - -Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-n *"name"*\] - -The following table describes the available command-line options. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionDescription

-?

Displays the Help for the Sdbinst.exe tool.

-

For example,

-

sdbinst.exe -?

-p

Allows SDBs installation with Patches

-

For example,

-

sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb

-q

Performs a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).

-

For example,

-

sdbinst.exe -q

-u filepath

Performs an uninstallation of the specified database.

-

For example,

-

sdbinst.exe -u C:\example.sdb

-g GUID

Specifies the customized database to uninstall by a globally unique identifier (GUID).

-

For example,

-

sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3

-n "name"

Specifies the customized database to uninstall by file name.

-

For example,

-

sdbinst.exe -n "My_Database"

- -## Related topics -[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) +--- +title: Using the Sdbinst.exe Command-Line Tool (Windows 10) +description: Learn how to deploy customized database (.sdb) files using the Sdbinst.exe Command-Line Tool. Review a list of command line options. +ms.assetid: c1945425-3f8d-4de8-9d2d-59f801f07034 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: plan +ms.pagetype: appcompat +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Using the Sdbinst.exe Command-Line Tool + + +**Applies to** + +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2016 +- Windows Server 2012 +- Windows Server 2008 R2 + +You must deploy your customized database (.sdb) files to other computers in your organization before your compatibility fixes, compatibility modes, and AppHelp messages are applied. You can deploy your customized database files in several ways, including by using a logon script, by using Group Policy, or by performing file copy operations. + +After you deploy and store the customized databases on each of your local computers, you must register the database files. Until you register the database files, the operating system is unable to identify the available compatibility fixes when starting an application. + +## Command-Line Options for Deploying Customized Database Files + +Sample output from the command `Sdbinst.exe /?` in an elevated CMD window: + +``` +Microsoft Windows [Version 10.0.14393] +(c) 2016 Microsoft Corporation. All rights reserved. + +C:\Windows\system32>Sdbinst.exe /? +Usage: Sdbinst.exe [-?] [-q] [-u] [-g] [-p] [-n[:WIN32|WIN64]] myfile.sdb | {guid} | "name" + + -? - print this help text. + -p - Allow SDBs containing patches. + -q - Quiet mode: prompts are auto-accepted. + -u - Uninstall. + -g {guid} - GUID of file (uninstall only). + -n "name" - Internal name of file (uninstall only). + +C:\Windows\system32>_ +``` + +The command-line options use the following conventions: + +Sdbinst.exe \[-?\] \[-p\] \[-q\] \[-u\] \[-g\] \[-u filepath\] \[-g *GUID*\] \[-n *"name"*\] + +The following table describes the available command-line options. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
OptionDescription

-?

Displays the Help for the Sdbinst.exe tool.

+

For example,

+

sdbinst.exe -?

-p

Allows SDBs installation with Patches

+

For example,

+

sdbinst.exe -p C:\Windows\AppPatch\Myapp.sdb

-q

Performs a silent installation with no visible window, status, or warning information. Fatal errors appear only in Event Viewer (Eventvwr.exe).

+

For example,

+

sdbinst.exe -q

-u filepath

Performs an uninstallation of the specified database.

+

For example,

+

sdbinst.exe -u C:\example.sdb

-g GUID

Specifies the customized database to uninstall by a globally unique identifier (GUID).

+

For example,

+

sdbinst.exe -g 6586cd8f-edc9-4ea8-ad94-afabea7f62e3

-n "name"

Specifies the customized database to uninstall by file name.

+

For example,

+

sdbinst.exe -n "My_Database"

+ +## Related topics +[Compatibility Administrator User's Guide](compatibility-administrator-users-guide.md) diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index b517ac9410..043e7d00ec 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -1,43 +1,44 @@ ---- -title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) -description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. -ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Volume Activation Management Tool (VAMT) Technical Reference - -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. -VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: -- Windows® 7 or above -- Windows Server 2008 R2 or above - - -**Important**   -VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or obove), Microsoft Office 2010 (or above). - -VAMT is only available in an EN-US (x86) package. - -## In this Section - -|Topic |Description | -|------|------------| -|[Introduction to VAMT](introduction-vamt.md) |Provides a description of VAMT and common usages. | -|[Active Directory-Based Activation Overview](active-directory-based-activation-overview.md) |Describes Active Directory-Based Activation scenarios. | -|[Install and Configure VAMT](install-configure-vamt.md) |Describes how to install VAMT and use it to configure client computers on your network. | -|[Add and Manage Products](add-manage-products-vamt.md) |Describes how to add client computers into VAMT. | -|[Manage Product Keys](manage-product-keys-vamt.md) |Describes how to add and remove a product key from VAMT. | -|[Manage Activations](manage-activations-vamt.md) |Describes how to activate a client computer by using a variety of activation methods. | -|[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | -|[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | -|[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | - +--- +title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) +description: The Volume Activation Management Tool (VAMT) enables network administrators to automate and centrally manage volume activation and retail activation. +ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Volume Activation Management Tool (VAMT) Technical Reference + +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. +VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: +- Windows® 7 or above +- Windows Server 2008 R2 or above + + +**Important**   +VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or obove), Microsoft Office 2010 (or above). + +VAMT is only available in an EN-US (x86) package. + +## In this Section + +|Topic |Description | +|------|------------| +|[Introduction to VAMT](introduction-vamt.md) |Provides a description of VAMT and common usages. | +|[Active Directory-Based Activation Overview](active-directory-based-activation-overview.md) |Describes Active Directory-Based Activation scenarios. | +|[Install and Configure VAMT](install-configure-vamt.md) |Describes how to install VAMT and use it to configure client computers on your network. | +|[Add and Manage Products](add-manage-products-vamt.md) |Describes how to add client computers into VAMT. | +|[Manage Product Keys](manage-product-keys-vamt.md) |Describes how to add and remove a product key from VAMT. | +|[Manage Activations](manage-activations-vamt.md) |Describes how to activate a client computer by using a variety of activation methods. | +|[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | +|[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | +|[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | + diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index 26151664de..ce54ecb1ff 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -1,275 +1,277 @@ ---- -title: Windows 10 deployment scenarios (Windows 10) -description: To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. -ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -keywords: upgrade, in-place, configuration, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.date: 11/06/2018 -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 deployment scenarios - -**Applies to** -- Windows 10 - -To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. - -The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. -- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). -- Dynamic deployment methods enable you to configure applications and settings for specific use cases. -- Traditional deployment methods use existing tools to deploy operating system images.
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
CategoryScenarioDescriptionMore information
Modern - -[Windows Autopilot](#windows-autopilot) - Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured. - -Overview of Windows Autopilot -
- -[In-place upgrade](#in-place-upgrade) - - - Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old. - -Perform an in-place upgrade to Windows 10 with MDT
Perform an in-place upgrade to Windows 10 using Configuration Manager -
- Dynamic - - -[Subscription Activation](#windows-10-subscription-activation) - - Switch from Windows 10 Pro to Enterprise when a subscribed user signs in. - -Windows 10 Subscription Activation -
- - [AAD / MDM](#dynamic-provisioning) - - The device is automatically joined to AAD and configured by MDM. - -Azure Active Directory integration with MDM -
- - [Provisioning packages](#dynamic-provisioning) - - Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices. - -Configure devices without MDM -
- Traditional - - - [Bare metal](#new-computer) - - Deploy a new device, or wipe an existing device and deploy with a fresh image. - - Deploy a Windows 10 image using MDT
Install a new version of Windows on a new computer with System Center Configuration Manager -
- - [Refresh](#computer-refresh) - - Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. - - Refresh a Windows 7 computer with Windows 10
Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager -
- - [Replace](#computer-replace) - - Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. - - Replace a Windows 7 computer with a Windows 10 computer
Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager -
- -
  - - ->[!IMPORTANT] ->The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
->Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. - -## Modern deployment methods - -Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience. - -### Windows Autopilot - -Windows Autopilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows Autopilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator. - -For more information about Windows Autopilot, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows Autopilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/). - -### In-place upgrade - -For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. - -Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like System Center Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. - -The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. - -Because existing applications are preserved through the process, the upgrade process uses the standard Windows installation media image (Install.wim); custom images are not needed and cannot be used because the upgrade process is unable to deal with conflicts between apps in the old and new operating system. (For example, Contoso Timecard 1.0 in Windows 7 and Contoso Timecard 3.0 in the Windows 10 image.) - -Scenarios that support in-place upgrade with some additional procedures include changing from BIOS to UEFI boot mode and upgrade of devices that use non-Microsoft disk encryption software. - -- **Legacy BIOS to UEFI booting**: To perform an in-place upgrade on a UEFI-capable system that currently boots using legacy BIOS, first perform the in-place upgrade to Windows 10, maintaining the legacy BIOS boot mode. Windows 10 does not require UEFI, so it will work fine to upgrade a system using legacy BIOS emulation. After the upgrade, if you wish to enable Windows 10 features that require UEFI (such as Secure Boot), you can convert the system disk to a format that supports UEFI boot using the [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) tool. Note: [UEFI specification](http://www.uefi.org/specifications) requires GPT disk layout. After the disk has been converted, you must also configure the firmware to boot in UEFI mode. - -- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: - - [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) - - [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) - -There are some situations where you cannot use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: - -- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process cannot change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. -- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. -- Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS. -- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken. - - -## Dynamic provisioning - -For new PCs, organizations have historically replaced the version of Windows included on the device with their own custom Windows image, because this was often faster and easier than leveraging the preinstalled version. But this is an added expense due to the time and effort required. With the new dynamic provisioning capabilities and tools provided with Windows 10, it is now possible to avoid this. - -The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include: - -### Windows 10 Subscription Activation - -Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation). - - -### Azure Active Directory (AAD) join with automatic mobile device management (MDM) enrollment - -In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm). - -### Provisioning package configuration - -Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm). - -These scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios). - -While the initial Windows 10 release includes a variety of provisioning settings and deployment mechanisms, these will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for additional features through the Windows Feedback app or through their Microsoft Support contacts. - -## Traditional deployment: - -New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [System Center Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). - -With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important and will continue to be available to organizations that need them. - -The traditional deployment scenario can be divided into different sub-scenarios. These are explained in detail in the following sections, but the following provides a brief summary: - -- **New computer.** A bare-metal deployment of a new machine. - -- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). - -- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). - -### New computer - -Also called a "bare metal" deployment. This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD). - -The deployment process for the new machine scenario is as follows: - -1. Start the setup from boot media (CD, USB, ISO, or PXE). - -2. Wipe the hard disk clean and create new volume(s). - -3. Install the operating system image. - -4. Install other applications (as part of the task sequence). - -After taking these steps, the computer is ready for use. - -### Computer refresh - -A refresh is sometimes called wipe-and-load. The process is normally initiated in the running operating system. User data and settings are backed up and restored later as part of the deployment process. The target can be the same as for the new computer scenario. - -The deployment process for the wipe-and-load scenario is as follows: - -1. Start the setup on a running operating system. - -2. Save the user state locally. - -3. Wipe the hard disk clean (except for the folder containing the backup). - -4. Install the operating system image. - -5. Install other applications. - -6. Restore the user state. - -After taking these steps, the machine is ready for use. - -### Computer replace - -A computer replace is similar to the refresh scenario. However, since we are replacing the machine, we divide this scenario into two main tasks: backup of the old client and bare-metal deployment of the new client. As with the refresh scenario, user data and settings are backed up and restored. - -The deployment process for the replace scenario is as follows: - -1. Save the user state (data and settings) on the server through a backup job on the running operating system. - -2. Deploy the new computer as a bare-metal deployment. - - **Note**
In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk. - -## Related topics - -- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) -- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230) -- [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357) -- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=619358) -- [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619359) +--- +title: Windows 10 deployment scenarios (Windows 10) +description: Understand the different ways Windows 10 operating system can be deployed in your organization. Explore several Windows 10 deployment scenarios. +ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.date: 11/06/2018 +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 deployment scenarios + +**Applies to** +- Windows 10 + +To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. + +The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. +- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). +- Dynamic deployment methods enable you to configure applications and settings for specific use cases. +- Traditional deployment methods use existing tools to deploy operating system images.
  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryScenarioDescriptionMore information
Modern + +[Windows Autopilot](#windows-autopilot) + Customize the out-of-box-experience (OOBE) for your organization, and deploy a new system with apps and settings already configured. + +Overview of Windows Autopilot +
+ +[In-place upgrade](#in-place-upgrade) + + + Use Windows Setup to update your OS and migrate apps and settings. Rollback data is saved in Windows.old. + +Perform an in-place upgrade to Windows 10 with MDT
Perform an in-place upgrade to Windows 10 using Configuration Manager +
+ Dynamic + + +[Subscription Activation](#windows-10-subscription-activation) + + Switch from Windows 10 Pro to Enterprise when a subscribed user signs in. + +Windows 10 Subscription Activation +
+ + [AAD / MDM](#dynamic-provisioning) + + The device is automatically joined to AAD and configured by MDM. + +Azure Active Directory integration with MDM +
+ + [Provisioning packages](#dynamic-provisioning) + + Using the Windows Imaging and Configuration Designer tool, create provisioning packages that can be applied to devices. + +Configure devices without MDM +
+ Traditional + + + [Bare metal](#new-computer) + + Deploy a new device, or wipe an existing device and deploy with a fresh image. + + Deploy a Windows 10 image using MDT
Install a new version of Windows on a new computer with System Center Configuration Manager +
+ + [Refresh](#computer-refresh) + + Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. + + Refresh a Windows 7 computer with Windows 10
Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager +
+ + [Replace](#computer-replace) + + Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. + + Replace a Windows 7 computer with a Windows 10 computer
Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager +
+ +
  + + +>[!IMPORTANT] +>The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
+>Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. + +## Modern deployment methods + +Modern deployment methods embrace both traditional on-prem and cloud services to deliver a simple, streamlined, cost effective deployment experience. + +### Windows Autopilot + +Windows Autopilot is a new suite of capabilities designed to simplify and modernize the deployment and management of new Windows 10 PCs. Windows Autopilot enables IT professionals to customize the Out of Box Experience (OOBE) for Windows 10 PCs and provide end users with a fully configured new Windows 10 device after just a few clicks. There are no images to deploy, no drivers to inject, and no infrastructure to manage. Users can go through the deployment process independently, without the need consult their IT administrator. + +For more information about Windows Autopilot, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-10-auto-pilot) and [Modernizing Windows deployment with Windows Autopilot](https://blogs.technet.microsoft.com/windowsitpro/2017/06/29/modernizing-windows-deployment-with-windows-autopilot/). + +### In-place upgrade + +For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. + +Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like System Center Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. + +The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. + +Because existing applications are preserved through the process, the upgrade process uses the standard Windows installation media image (Install.wim); custom images are not needed and cannot be used because the upgrade process is unable to deal with conflicts between apps in the old and new operating system. (For example, Contoso Timecard 1.0 in Windows 7 and Contoso Timecard 3.0 in the Windows 10 image.) + +Scenarios that support in-place upgrade with some additional procedures include changing from BIOS to UEFI boot mode and upgrade of devices that use non-Microsoft disk encryption software. + +- **Legacy BIOS to UEFI booting**: To perform an in-place upgrade on a UEFI-capable system that currently boots using legacy BIOS, first perform the in-place upgrade to Windows 10, maintaining the legacy BIOS boot mode. Windows 10 does not require UEFI, so it will work fine to upgrade a system using legacy BIOS emulation. After the upgrade, if you wish to enable Windows 10 features that require UEFI (such as Secure Boot), you can convert the system disk to a format that supports UEFI boot using the [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) tool. Note: [UEFI specification](http://www.uefi.org/specifications) requires GPT disk layout. After the disk has been converted, you must also configure the firmware to boot in UEFI mode. + +- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: + - [Windows Setup Automation Overview](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-automation-overview) + - [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) + +There are some situations where you cannot use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: + +- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process cannot change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. +- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. +- Updating existing images. While it might be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image, this is not supported – preparing an upgraded OS for imaging (using Sysprep.exe) is not supported and will not work when it detects the upgraded OS. +- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS; if using dual-boot or multi-boot systems with multiple operating systems (not leveraging virtual machines for the second and subsequent operating systems), additional care should be taken. + + +## Dynamic provisioning + +For new PCs, organizations have historically replaced the version of Windows included on the device with their own custom Windows image, because this was often faster and easier than leveraging the preinstalled version. But this is an added expense due to the time and effort required. With the new dynamic provisioning capabilities and tools provided with Windows 10, it is now possible to avoid this. + +The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include: + +### Windows 10 Subscription Activation + +Windows 10 Subscription Activation is a modern deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation). + + +### Azure Active Directory (AAD) join with automatic mobile device management (MDM) enrollment + +In this scenario, the organization member just needs to provide their work or school user ID and password; the device can then be automatically joined to Azure Active Directory and enrolled in a mobile device management (MDM) solution with no additional user interaction. Once done, the MDM solution can finish configuring the device as needed. For more information, see [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm). + +### Provisioning package configuration + +Using the [Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkId=619358), IT administrators can create a self-contained package that contains all of the configuration, settings, and apps that need to be applied to a machine. These packages can then be deployed to new PCs through a variety of means, typically by IT professionals. For more information, see [Configure devices without MDM](/windows/configuration/configure-devices-without-mdm). + +These scenarios can be used to enable “choose your own device” (CYOD) programs where the organization’s users can pick their own PC and not be restricted to a small list of approved or certified models (programs that are difficult to implement using traditional deployment scenarios). + +While the initial Windows 10 release includes a variety of provisioning settings and deployment mechanisms, these will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for additional features through the Windows Feedback app or through their Microsoft Support contacts. + +## Traditional deployment: + +New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [System Center Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). + +With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important and will continue to be available to organizations that need them. + +The traditional deployment scenario can be divided into different sub-scenarios. These are explained in detail in the following sections, but the following provides a brief summary: + +- **New computer.** A bare-metal deployment of a new machine. + +- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). + +- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). + +### New computer + +Also called a "bare metal" deployment. This scenario occurs when you have a blank machine you need to deploy, or an existing machine you want to wipe and redeploy without needing to preserve any existing data. The setup starts from a boot media, using CD, USB, ISO, or Pre-Boot Execution Environment (PXE). You can also generate a full offline media that includes all the files needed for a client deployment, allowing you to deploy without having to connect to a central deployment share. The target can be a physical computer, a virtual machine, or a Virtual Hard Disk (VHD) running on a physical computer (boot from VHD). + +The deployment process for the new machine scenario is as follows: + +1. Start the setup from boot media (CD, USB, ISO, or PXE). + +2. Wipe the hard disk clean and create new volume(s). + +3. Install the operating system image. + +4. Install other applications (as part of the task sequence). + +After taking these steps, the computer is ready for use. + +### Computer refresh + +A refresh is sometimes called wipe-and-load. The process is normally initiated in the running operating system. User data and settings are backed up and restored later as part of the deployment process. The target can be the same as for the new computer scenario. + +The deployment process for the wipe-and-load scenario is as follows: + +1. Start the setup on a running operating system. + +2. Save the user state locally. + +3. Wipe the hard disk clean (except for the folder containing the backup). + +4. Install the operating system image. + +5. Install other applications. + +6. Restore the user state. + +After taking these steps, the machine is ready for use. + +### Computer replace + +A computer replace is similar to the refresh scenario. However, since we are replacing the machine, we divide this scenario into two main tasks: backup of the old client and bare-metal deployment of the new client. As with the refresh scenario, user data and settings are backed up and restored. + +The deployment process for the replace scenario is as follows: + +1. Save the user state (data and settings) on the server through a backup job on the running operating system. + +2. Deploy the new computer as a bare-metal deployment. + + **Note**
In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk. + +## Related topics + +- [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) +- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230) +- [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) +- [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357) +- [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkId=619358) +- [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619359) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 3869b97501..610edeb54d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,6 +1,6 @@ --- title: Manage Windows Defender Credential Guard (Windows 10) -description: Deploying and managing Windows Defender Credential Guard using Group Policy, the registry, or the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool. +description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 18314f3f58..c0e102cb90 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -1,6 +1,6 @@ --- title: Windows Hello biometrics in the enterprise (Windows 10) -description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. +description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc ms.reviewer: keywords: Windows Hello, enterprise biometrics diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index fe21575b2b..57ea7bc917 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -1,6 +1,6 @@ --- title: Audit File System (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. +description: The Advanced Security Audit policy setting, Audit File System, determines if audit events are generated when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 3802d34249..64fd2edce2 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -1,6 +1,6 @@ --- title: Audit Handle Manipulation (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. +description: The Advanced Security Audit policy setting, Audit Handle Manipulation, determines if audit events are generated when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 54e46c85cd..290c41687a 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -1,6 +1,6 @@ --- title: Audit IPsec Quick Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +description: The policy setting, Audit IPsec Quick Mode, decides if audit events are generated for the results of the IKE protocol and AuthIP during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index 45e9abeb45..c4d6606795 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -1,6 +1,6 @@ --- title: Audit Logoff (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. +description: The Advanced Security Audit policy setting, Audit Logoff, determines if audit events are generated when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index 3bfc786df1..54b132e114 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -1,6 +1,6 @@ --- title: Audit Other Object Access Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. +description: The policy setting, Audit Other Object Access Events, determines if audit events are generated for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md index 943eff5d1e..14dccc71b4 100644 --- a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md @@ -1,6 +1,6 @@ --- title: Monitor resource attribute definitions (Windows 10) -description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. +description: Learn how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects. ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index b163b7b6f6..18d2e3d8c2 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -1,6 +1,6 @@ --- title: Monitor the use of removable storage devices (Windows 10) -description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects. +description: Learn how advanced security auditing options can be used to monitor attempts to use removable storage devices to access network resources. ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md index 1964224c17..606e073432 100644 --- a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md @@ -1,6 +1,6 @@ --- title: Monitor user and device claims during sign-in (Windows 10) -description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects. +description: Learn how to monitor user and device claims that are associated with a user’s security token. This advice assumes you have deployed Dynamic Access Control. ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md index 0eb9f57648..b005d81545 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md @@ -1,7 +1,7 @@ --- title: Microsoft Cloud App Security integration overview ms.reviewer: -description: Microsoft Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage +description: Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) integrates with Cloud App Security by forwarding all cloud app networking activities. keywords: cloud, app, networking, visibility, usage search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 07bd73d2d2..efda66d339 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -1,6 +1,6 @@ --- title: What's in the dashboard and what it means for my organization's security posture -description: What's in the Threat & Vulnerability Management dashboard and how it can help SecOps and Security Administrators arrive at informed decisions to address cybersecurity threat vulnerabilities and build their organization's security resilience. +description: The Threat & Vulnerability Management dashboard can help SecOps and security admins address cybersecurity threats and build their org's security resilience. keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, risk-based threat & vulnerability management, security configuration, configuration score, exposure score search.appverid: met150 search.product: eADQiWindows 10XVcnh diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index aafd2f2e36..ee48894e3f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -1,6 +1,6 @@ --- title: Exposure score -description: Your exposure level reflects how vulnerable your organization is to cybersecurity threats. Apply the Threat & Vulnerability Management security recommendations to keep your exposure level low. +description: The Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) exposure score reflects how vulnerable your organization is to cybersecurity threats. keywords: exposure score, mdatp exposure score, mdatp tvm exposure score, organization exposure score, tvm organization exposure score search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md index d1dd82ef56..518c760a7e 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md @@ -1,6 +1,6 @@ --- title: Allow log on through Remote Desktop Services (Windows 10) -description: Describes the best practices, location, values, policy management, and security considerations for the Allow log on through Remote Desktop Services security policy setting. +description: Best practices, location, values, policy management, and security considerations for the security policy setting, Allow log on through Remote Desktop Services. ms.assetid: 6267c376-8199-4f2b-ae56-9c5424e76798 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index 5440a05596..e1c7f49296 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -1,6 +1,6 @@ --- title: Domain member Digitally encrypt or sign secure channel data (always) (Windows 10) -description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt or sign secure channel data (always) security policy setting. +description: Best practices, location, values, and security considerations for the policy setting, Domain member Digitally encrypt or sign secure channel data (always). ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index e91f76f50f..0540ffa16a 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -1,6 +1,6 @@ --- title: Domain member Digitally encrypt secure channel data (when possible) (Windows 10) -description: Describes the best practices, location, values, and security considerations for the Domain member Digitally encrypt secure channel data (when possible) security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Domain member Digitally encrypt secure channel data (when possible). ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md index a66a0bb4f3..bf4611c235 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -1,6 +1,6 @@ --- title: Interactive logon Message title for users attempting to log on (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Message title for users attempting to log on security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Interactive logon Message title for users attempting to log on. ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md index 07d967bae1..c9c8515fe5 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md @@ -1,6 +1,6 @@ --- title: Interactive logon Smart card removal behavior (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the Interactive logon Smart card removal behavior security policy setting. +description: Best practices, location, values, policy management and security considerations for the security policy setting, Interactive logon Smart card removal behavior. ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md index e54608a533..f45ef84792 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md @@ -1,6 +1,6 @@ --- title: Microsoft network server Server SPN target name validation level (Windows 10) -description: Describes the best practices, location, and values, policy management and security considerations for the Microsoft network server Server SPN target name validation level security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Microsoft network server Server SPN target name validation level. ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index 8c939ae9a5..872e3aaf36 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -1,6 +1,6 @@ --- title: Network security Restrict NTLM Audit NTLM authentication in this domain (Windows 10) -description: Describes the best practices, location, values, management aspects, and security considerations for the Network Security Restrict NTLM Audit NTLM authentication in this domain security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Network Security Restrict NTLM Audit NTLM authentication in this domain. ms.assetid: 33183ef9-53b5-4258-8605-73dc46335e6e ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md index 0695e1fc82..885ca9c205 100644 --- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md @@ -1,6 +1,6 @@ --- title: Recovery console Allow automatic administrative logon (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the Recovery console Allow automatic administrative logon security policy setting. +description: Best practices, location, values, policy management and security considerations for the policy setting, Recovery console Allow automatic administrative logon. ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 ms.reviewer: ms.author: dansimp From c231242d52a22ec7da56df165a657b405fcf5030 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 2 Jan 2020 11:59:58 -0800 Subject: [PATCH 075/335] pencil edit line 27 --- .../volume-activation/volume-activation-management-tool.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index 043e7d00ec..c73cbc4546 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -24,7 +24,7 @@ VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the W **Important**   -VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or obove), Microsoft Office 2010 (or above). +VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or later), Microsoft Office 2010 (or above). VAMT is only available in an EN-US (x86) package. From 3439f327d82a22263113bf97d6f752b9c32bc216 Mon Sep 17 00:00:00 2001 From: Tina Burden Date: Thu, 2 Jan 2020 12:01:04 -0800 Subject: [PATCH 076/335] pencil edit line 40 --- ...mber-digitally-encrypt-or-sign-secure-channel-data-always.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index e1c7f49296..065ea3434c 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -37,7 +37,7 @@ The following policy settings determine whether a secure channel can be establis Setting **Domain member: Digitally encrypt or sign secure channel data (always)** to **Enabled** prevents establishing a secure channel with any domain controller that cannot sign or encrypt all secure channel data. -To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a device running Windows othat has joined a domain to have access to the user account database in its domain and in any trusted domains. +To protect authentication traffic from man-in-the-middle, replay, and other types of network attacks, Windows-based computers create a communication channel through NetLogon called secure channels. These channels authenticate machine accounts. They also authenticate user accounts when a remote user connects to a network resource and the user account exists in a trusted domain. This is called pass-through authentication, and it allows a device running Windows that has joined a domain to have access to the user account database in its domain and in any trusted domains. To enable the **Domain member: Digitally encrypt or sign secure channel data (always)** policy setting on a member workstation or server, all domain controllers in the domain that the member belongs to must be capable of signing or encrypting all secure-channel data. From 866a1299748272cffb9e57198531fb816d9fc2b8 Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 12:56:21 -0800 Subject: [PATCH 077/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 7cfd7c2c0d..afe15f75a2 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -50,7 +50,9 @@ With Windows 10, you can create provisioning packages that let you quickly and e It provides the following benefits: - The algorithm is FIPS-compliant. - Easy to administer. You can use the BitLocker Wizard, manage-bde, Group Policy, MDM policy, Windows PowerShell, or WMI to manage it on devices in your organization. - >**Note:** Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. + +>[!NOTE] +>Drives encrypted with XTS-AES will not be accessible on older version of Windows. This is only recommended for fixed and operating system drives. Removable drives should continue to use the AES-CBC 128-bit or AES-CBC 256-bit algorithms. #### New Bitlocker features in Windows 10, version 1507 From 1769114ecd3975d2d6383f3f2b706a3a2878b3a7 Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:01:36 -0800 Subject: [PATCH 078/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index afe15f75a2..5fd391535a 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -32,9 +32,9 @@ With Windows 10, you can create provisioning packages that let you quickly and e ## Security -### Applocker +### AppLocker -#### New Applocker features in Windows 10, version 1507 +#### New AppLocker features in Windows 10, version 1507 - A new parameter was added to the [New-AppLockerPolicy](https://technet.microsoft.com/library/hh847211.aspx) Windows PowerShell cmdlet that lets you choose whether executable and DLL rule collections apply to non-interactive processes. To enable this, set the **ServiceEnforcement** to **Enabled**. - A new [AppLocker](https://msdn.microsoft.com/library/windows/hardware/dn920019.aspx) configuration service provider was add to allow you to enable AppLocker rules by using an MDM server. From c704ef14edbf290ea3d42cf753d68359bb16d928 Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:03:27 -0800 Subject: [PATCH 079/335] Update whats-new-windows-10-version-1507-and-1511.md --- windows/whats-new/whats-new-windows-10-version-1507-and-1511.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 5fd391535a..9da72a7d45 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -227,7 +227,7 @@ Some things that you can check on the device are: User Account Control (UAC) helps prevent malware from damaging a computer and helps organizations deploy a better-managed desktop environment. -You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Univeral Windows Platform apps stop working. You must always set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10. +You should not turn off UAC because this is not a supported scenario for devices running Windows 10. If you do turn off UAC, all Universal Windows Platform apps stop working. You must always set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA** registry value to 1. If you need to provide auto elevation for programmatic access or installation, you could set the **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin** registry value to 0, which is the same as setting the UAC slider Never Notify. This is not recommended for devices running Windows 10. For more info about how manage UAC, see [UAC Group Policy Settings and Registry Key Settings](/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings). From 3e15c63bba2f1900dfdfb86e04cb500d76e6233b Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:11:06 -0800 Subject: [PATCH 080/335] Update whats-new-windows-10-version-1507-and-1511.md --- windows/whats-new/whats-new-windows-10-version-1507-and-1511.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 9da72a7d45..458947161c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -283,7 +283,7 @@ Enterprises have the following identity and management choices. | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | >[!NOTE]   ->With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). +> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From fd75d41141534d58d5498eeba3add728f97e3f41 Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:29:24 -0800 Subject: [PATCH 081/335] Update whats-new-windows-10-version-1507-and-1511.md --- windows/whats-new/whats-new-windows-10-version-1507-and-1511.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 458947161c..9da72a7d45 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -283,7 +283,7 @@ Enterprises have the following identity and management choices. | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | >[!NOTE]   -> With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). +>With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From fc63402bde48ee2a2ec7036f0a597a0ebf5f013c Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:38:39 -0800 Subject: [PATCH 082/335] Update whats-new-windows-10-version-1507-and-1511.md --- windows/whats-new/whats-new-windows-10-version-1507-and-1511.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 9da72a7d45..082bed9f47 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -282,6 +282,7 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | + >[!NOTE]   >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). From cb6e52e740e31ed67b7844dafe6279d30e6eb40c Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 13:54:39 -0800 Subject: [PATCH 083/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 082bed9f47..5cd5ffecd5 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -282,9 +282,8 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | - ->[!NOTE]   ->With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). + >[!NOTE]   + >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From 122c0489ffb98947b4a1e58775203ae56b95223d Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 14:11:49 -0800 Subject: [PATCH 084/335] Update whats-new-windows-10-version-1507-and-1511.md --- windows/whats-new/whats-new-windows-10-version-1507-and-1511.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 5cd5ffecd5..87305892c3 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -282,6 +282,8 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | + + >[!NOTE]   >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). From 4fad70bde00c2120866ca22cc2722776edeb7af2 Mon Sep 17 00:00:00 2001 From: martyav Date: Thu, 2 Jan 2020 17:21:45 -0500 Subject: [PATCH 085/335] items through 224 reviewed --- .../mdm/enterprisedataprotection-csp.md | 2 +- .../mdm/networkqospolicy-ddf.md | 2 +- .../mdm/passportforwork-ddf.md | 2 +- .../mdm/secureassessment-ddf-file.md | 2 +- .../cortana-at-work/cortana-at-work-crm.md | 2 +- .../configure-mdt-settings.md | 101 +++++++++--------- ...ntegrate-configuration-manager-with-mdt.md | 2 +- ...prepare-for-windows-deployment-with-mdt.md | 2 +- ...s-screen-in-compatibility-administrator.md | 2 +- .../windows-deployment-scenarios-and-tools.md | 2 +- ...smart-card-understanding-and-evaluating.md | 2 +- .../bitlocker/bitlocker-upgrading-faq.md | 2 +- .../enlightened-microsoft-apps-and-wip.md | 2 +- ...-detailed-directory-service-replication.md | 2 +- .../auditing/audit-group-membership.md | 2 +- .../audit-other-logonlogoff-events.md | 2 +- .../threat-protection/auditing/event-4952.md | 2 +- ...le-system-global-object-access-auditing.md | 2 +- ...-monitor-dynamic-access-control-objects.md | 2 +- ...criptor-definition-language-sddl-syntax.md | 2 +- ...-sign-secure-channel-data-when-possible.md | 2 +- ...ance-for-computer-clock-synchronization.md | 2 +- ...cess-remotely-accessible-registry-paths.md | 2 +- ...lm-add-server-exceptions-in-this-domain.md | 2 +- ...er-digitally-sign-communications-always.md | 2 +- ...ly-sign-communications-if-client-agrees.md | 2 +- ...r-administrators-in-admin-approval-mode.md | 2 +- ...ecutables-that-are-signed-and-validated.md | 2 +- ...ine-your-application-control-objectives.md | 2 +- ...er-application-control-deployment-guide.md | 2 +- 30 files changed, 80 insertions(+), 79 deletions(-) diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 3e69ceaa92..a4314f878b 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -1,6 +1,6 @@ --- title: EnterpriseDataProtection CSP -description: The EnterpriseDataProtection configuration service provider (CSP) is used to configure Windows Information Protection (WIP) (formerly known as Enterprise Data Protection) specific settings. +description: The EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings. ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3 ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 7ee6042e75..7535a3ce20 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,6 +1,6 @@ --- title: NetworkQoSPolicy DDF -description: This topic shows the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML ms.assetid: ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 7eaea8a237..f5b345d7d6 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,6 +1,6 @@ --- title: PassportForWork DDF -description: This topic shows the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: A2182898-1577-4675-BAE5-2A3A9C2AAC9B ms.reviewer: manager: dansimp diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index f294bbb8a3..383470060b 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,6 +1,6 @@ --- title: SecureAssessment DDF file -description: This topic shows the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML ms.assetid: 68D17F2A-FAEA-4608-8727-DBEC1D7BE48A ms.reviewer: manager: dansimp diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 095fa77861..250b7d99b0 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -1,6 +1,6 @@ --- title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows 10) -description: How to set up Cortana to help your salespeople get proactive insights on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. +description: How to set up Cortana to give salespeople insights on important CRM activities, including sales leads, accounts, and opportunities. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md index 4f3771b9d5..2b89867e2e 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md @@ -1,50 +1,51 @@ ---- -title: Configure MDT settings (Windows 10) -description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. -ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 -ms.reviewer: -manager: laurawi -ms.author: greglin -keywords: customize, customization, deploy, features, tools -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Configure MDT settings - -One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. -For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). - -![figure 1](../images/mdt-09-fig01.png) - -Figure 1. The machines used in this topic. - -## In this section - -- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) -- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) -- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) -- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) -- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) -- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) -- [Use web services in MDT](use-web-services-in-mdt.md) -- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) - -## Related topics - -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) - -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) - -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) - -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) - -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +--- +title: Configure MDT settings (Windows 10) +description: One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities. Learn how to customize your environment. +ms.assetid: d3e1280c-3d1b-4fad-8ac4-b65dc711f122 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: customize, customization, deploy, features, tools +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Configure MDT settings + +One of the most powerful features in Microsoft Deployment Toolkit (MDT) is its extension capabilities; there is virtually no limitation to what you can do in terms of customization. In this topic, you learn about configuring customizations for your environment. +For the purposes of this topic, we will use four machines: DC01, MDT01, HV01, and PC0001. DC01 is a domain controller, MDT01 is a Windows Server 2012 R2 Standard server, and PC0001 is a Windows 10 Enterprise x64 client used for the MDT simulation environment. OR01 has Microsoft System Center 2012 R2 Orchestrator installed. MDT01, OR01, and PC0001 are members of the domain contoso.com for the fictitious Contoso Corporation. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-10-with-the-microsoft-deployment-toolkit.md#proof). + +![figure 1](../images/mdt-09-fig01.png) + +Figure 1. The machines used in this topic. + +## In this section + +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) + +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md) + +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) + +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) + +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) + +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) diff --git a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md b/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md index 6ebe0fe528..54b6e72815 100644 --- a/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt.md @@ -1,6 +1,6 @@ --- title: Integrate Configuration Manager with MDT (Windows 10) -description: This topic will help you understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy a new or updated version of the Windows operating system. +description: Understand the benefits of integrating the Microsoft Deployment Toolkit with Microsoft System Center 2012 R2 Configuration Manager SP1 when you deploy Windows. ms.assetid: 3bd1cf92-81e5-48dc-b874-0f5d9472e5a5 ms.reviewer: manager: laurawi diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 2e1b06b5f4..aa2e3ff40e 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -1,6 +1,6 @@ --- title: Prepare for deployment with MDT (Windows 10) -description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). +description: Learn how to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 ms.reviewer: manager: laurawi diff --git a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md index 579f4b8bfa..67a11cd90f 100644 --- a/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md +++ b/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator.md @@ -1,6 +1,6 @@ --- title: Viewing the Events Screen in Compatibility Administrator (Windows 10) -description: The Events screen enables you to record and to view your activities in the Compatibility Administrator tool, provided that the screen is open while you perform the activities. +description: You can use the Events screen to record and view activities in the Compatibility Administrator tool. ms.assetid: f2b2ada4-1b7b-4558-989d-5b52b40454b3 ms.reviewer: manager: laurawi diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 72b8aaf445..8c74c372fe 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -1,6 +1,6 @@ --- title: Windows 10 deployment scenarios and tools -description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. +description: Learn about the tools you can use to deploy Windows 10 and related applications to your organization. Explore deployment scenarios. ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 ms.reviewer: manager: laurawi diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index aab4745ee9..0194ee2c80 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -1,6 +1,6 @@ --- title: Understanding and Evaluating Virtual Smart Cards (Windows 10) -description: This topic for IT professional provides information about how smart card technology can fit into your authentication design, and provides links to additional topics about virtual smart cards. +description: Learn how smart card technology can fit into your authentication design. Find links to additional topics about virtual smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md index 15cb20e4f6..7873e99c18 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -1,6 +1,6 @@ --- title: BitLocker Upgrading FAQ (Windows 10) -description: Learn more about upgrading systems that have BitLocker enabled. +description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?" ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 93a5d00470..37be2ff41c 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -1,6 +1,6 @@ --- title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10) -description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. +description: Learn the difference between enlightened and unenlightened apps. Find out which enlightened apps are provided by Microsoft. Learn how to allow-list them. ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index 2b345207d2..859859fc2b 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -1,6 +1,6 @@ --- title: Audit Detailed Directory Service Replication (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. +description: The Audit Detailed Directory Service Replication setting decides if audit events contain detailed tracking info about data replicated between domain controllers ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index 18b2e9556d..e9047b6c8a 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -1,6 +1,6 @@ --- title: Audit Group Membership (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. +description: The advanced security audit policy setting, Audit Group Membership, enables you to audit group memberships when they are enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index b10a5106ba..9265129828 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -1,6 +1,6 @@ --- title: Audit Other Logon/Logoff Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. +description: The Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, determines if Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 ms.reviewer: manager: dansimp diff --git a/windows/security/threat-protection/auditing/event-4952.md b/windows/security/threat-protection/auditing/event-4952.md index dd7bb7d69d..0bd8a3b9b6 100644 --- a/windows/security/threat-protection/auditing/event-4952.md +++ b/windows/security/threat-protection/auditing/event-4952.md @@ -1,6 +1,6 @@ --- title: 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. (Windows 10) -description: Describes security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. +description: Security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md index 782e49e3bc..c9d3a1c9ba 100644 --- a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md @@ -1,6 +1,6 @@ --- title: File System (Global Object Access Auditing) (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, File System (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the file system for an entire computer. +description: The policy setting, File System (Global Object Access Auditing), enables you to configure a global system access control list (SACL) for an entire computer. ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 919b779ce8..91e999ee6e 100644 --- a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -1,6 +1,6 @@ --- title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10) -description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. +description: Domain admins can set up advanced security audit options in Windows 10 to target specific users, or monitor potentially significant activity on multiple devices ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 01185ae6a6..1e3fb1aac8 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -1,6 +1,6 @@ --- title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax (Windows 10) -description: Describes the best practices, location, values, and security considerations for the DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax security policy setting. +description: Best practices and more for the security policy setting, DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax. ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md index ad341bc3f9..e0127d72d7 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -1,6 +1,6 @@ --- title: Domain member Digitally sign secure channel data (when possible) (Windows 10) -description: Describes the best practices, location, values, and security considerations for the Domain member Digitally sign secure channel data (when possible) security policy setting. +description: Best practices, location, values, and security considerations for the security policy setting, Domain member Digitally sign secure channel data (when possible). ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md index cac506ca6d..880ce8d6ab 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md @@ -1,6 +1,6 @@ --- title: Maximum tolerance for computer clock synchronization (Windows 10) -description: Describes the best practices, location, values, policy management, and security considerations for the Maximum tolerance for computer clock synchronization security policy setting. +description: Best practices, location, values, policy management, and security considerations for the policy setting, Maximum tolerance for computer clock synchronization. ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md index b82dda2f41..62e028051b 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md @@ -1,6 +1,6 @@ --- title: Network access Remotely accessible registry paths (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the Network access Remotely accessible registry paths security policy setting. +description: Best practices, location, values, policy management and security considerations for the policy setting, Network access Remotely accessible registry paths. ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index bfc535dbd2..190741c9b6 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -1,6 +1,6 @@ --- title: Network security Restrict NTLM Add server exceptions in this domain (Windows 10) -description: Describes the best practices, location, values, management aspects, and security considerations for the Network security Restrict NTLM Add server exceptions in this domain security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Network security Restrict NTLM Add server exceptions in this domain. ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md index 52f64c04aa..dffc41d41d 100644 --- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-always.md @@ -1,6 +1,6 @@ --- title: SMB v1 Microsoft network server Digitally sign communications (always) (Windows 10) -description: For SMB v1 only, describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (always) security policy setting. +description: Best practices, security considerations, and more for the security policy setting, Microsoft network server Digitally sign communications (always). ms.assetid: 2007b622-7bc2-44e8-9cf1-d34b62117ea8 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md index 1ed8ae9b5b..45e242b7fc 100644 --- a/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md +++ b/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees.md @@ -1,6 +1,6 @@ --- title: SMBv1 Microsoft network server Digitally sign communications (if client agrees) (Windows 10) -description: For SMBv1 only, describes the best practices, location, values, policy management and security considerations for the Microsoft network server Digitally sign communications (if client agrees) security policy setting. +description: Best practices, security considerations and more for the security policy setting, Microsoft network server Digitally sign communications (if client agrees). ms.assetid: c92b2e3d-1dbf-4337-a145-b17a585f4fc1 ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index 9576d05d77..5b6f5b139e 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -1,6 +1,6 @@ --- title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode security policy setting. +description: Best practices and more for the security policy setting, User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index aea0ba3bb8..6846dd303b 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -1,6 +1,6 @@ --- title: User Account Control Only elevate executables that are signed and validated (Windows 10) -description: Describes the best practices, location, values, policy management and security considerations for the User Account Control Only elevate executables that are signed and validated security policy setting. +description: Best practices, security considerations, and more for the security policy setting, User Account Control Only elevate executables that are signed and validated. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index 7f43b4f3cd..b42a538517 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -1,6 +1,6 @@ --- title: Determine your application control objectives (Windows 10) -description: This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. +description: Determine which applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b ms.reviewer: ms.author: dansimp diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index 7b2d9a09d7..7be2503a64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -1,6 +1,6 @@ --- title: Planning and getting started on the Windows Defender Application Control deployment process (Windows 10) -description: Learn how to gather information, create a plan, and begin to create and test initial code integrity policies for your Windows Defender Application Control deployment. +description: Learn how to gather information, create a plan, and begin to test initial code integrity policies for a Windows Defender Application Control deployment. keywords: whitelisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 From b81d93f70dcf5e4b3ce390f982cdbea9c756cc77 Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 14:25:36 -0800 Subject: [PATCH 086/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new-windows-10-version-1507-and-1511.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 87305892c3..d7b88ca0f8 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -281,11 +281,10 @@ Enterprises have the following identity and management choices. | Identity | Active Directory; Azure AD | | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | +|---|---| - - - >[!NOTE]   - >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). +>[!NOTE]   +>With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From a592975e9ff950a35fced3adebf7d5197c5f246c Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 14:57:39 -0800 Subject: [PATCH 087/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index d7b88ca0f8..7996992f5a 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -281,10 +281,9 @@ Enterprises have the following identity and management choices. | Identity | Active Directory; Azure AD | | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | -|---|---| ->[!NOTE]   ->With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). + >[!NOTE]   + >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From 91ade006c2382768f51cfd43d26f0e63a39e955e Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 15:09:59 -0800 Subject: [PATCH 088/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 7996992f5a..27386a66fb 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -282,8 +282,10 @@ Enterprises have the following identity and management choices. | Grouping | Domain join; Workgroup; Azure AD join | | Device management | Group Policy; System Center Configuration Manager; Microsoft Intune; other MDM solutions; Exchange ActiveSync; Windows PowerShell; Windows Management Instrumentation (WMI) | - >[!NOTE]   - >With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). + + +>[!NOTE]   +>With the release of Windows Server 2012 R2, Network Access Protection (NAP) was deprecated and the NAP client has now been removed in Windows 10. For more information about support lifecycles, see [Microsoft Support Lifecycle](https://go.microsoft.com/fwlink/p/?LinkID=613512). ### Device lockdown From 210a5597e5d18e540631e258331ba26f244ada6b Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 2 Jan 2020 15:23:33 -0800 Subject: [PATCH 089/335] Added punctuation to help "where" seem less like a grammar problem --- .../windows-defender-application-control-deployment-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index 7be2503a64..232b40eec6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -46,7 +46,7 @@ This topic provides a roadmap for planning and getting started on the Windows De Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass WDAC. - For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your WDAC policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your WDAC policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used. + For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your WDAC policies. Other applications, where older versions of the application had vulnerabilities, also represent a risk. Therefore, you may want to deny or block such applications from your WDAC policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used. Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Application Control. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Microsoft recommended block rules](microsoft-recommended-block-rules.md). From 240725946040dfeeb15006a300781a24f9c311eb Mon Sep 17 00:00:00 2001 From: Ross McAllister Date: Thu, 2 Jan 2020 15:24:17 -0800 Subject: [PATCH 090/335] Update whats-new-windows-10-version-1507-and-1511.md --- .../whats-new/whats-new-windows-10-version-1507-and-1511.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index 27386a66fb..25b0e6cf11 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -218,6 +218,10 @@ Some things that you can check on the device are: - Is BitLocker Drive Encryption supported and enabled? - Is SecureBoot supported and enabled? + +
+ + >[!NOTE] >The device must be running Windows 10 and it must support at least TPM 2.0. From 56304ba7026487db33a4428ff357c0e4f778b5b2 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 2 Jan 2020 15:28:34 -0800 Subject: [PATCH 091/335] Changed "Dll" to "DLL" --- .../determine-your-application-control-objectives.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index b42a538517..adcfdab2e0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -77,7 +77,7 @@ Use the following table to develop your own objectives and determine which appli

SRP can control the following file types:

  • Executables

    • -

  • Dlls

    • +

  • DLLs

  • Scripts

  • Windows Installers

@@ -85,7 +85,7 @@ Use the following table to develop your own objectives and determine which appli

AppLocker can control the following file types: