deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-17 19:33:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'master' into understand-malware

Browse Source
This commit is contained in:
Beth Levin
2019-03-25 09:25:01 -07:00
parent 74925d2d65 66746814ac
commit d2e55df715
16 changed files with 46 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md
View File

@ -95,6 +95,7 @@ This policy setting controls whether the elevation request prompt is displayed o
- **Enabled** (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.
- **Disabled** All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used.
## User Account Control: Virtualize file and registry write failures to per-user locations
This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\\system32, or HKLM\\Software.

10
windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md
View File

@ -15,12 +15,12 @@ ms.topic: conceptual
ms.date: 04/19/2017
---
# Network security: Configure encryption types allowed for Kerberos Win7 only
# Network security: Configure encryption types allowed for Kerberos
**Applies to**
- Windows 10
Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos Win7 only** security policy setting.
Describes the best practices, location, values and security considerations for the **Network security: Configure encryption types allowed for Kerberos** security policy setting.
## Reference
@ -67,9 +67,9 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec
| Default domain policy| Not defined|
| Default domain controller policy| Not defined|
| Stand-alone server default settings | Not defined|
| Domain controller effective default settings | None of these encryption types that are available in this policy are allowed.|
| Member server effective default settings | None of these encryption types that are available in this policy are allowed.|
| Effective GPO default settings on client computers | None of these encryption types that are available in this policy are allowed.|
| Domain controller effective default settings | The default OS setting applies, DES suites are not supported by default.|
| Member server effective default settings | The default OS setting applies, DES suites are not supported by default.|
| Effective GPO default settings on client computers | The default OS setting applies, DES suites are not supported by default.|
 
## Security considerations

1
windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md
View File

@ -14,7 +14,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
ms.date: 30/07/2018
---
# Supported Windows Defender ATP query APIs

10
windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
View File

@ -67,7 +67,15 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
1. Select the alert you'd like to suppress. This brings up the **Alert management** pane.
2. Select **Create a supression rule**.
2. Select **Create a suppression rule**.
You can create a suppression rule based on the following attributes:
* File hash
* File name - wild card supported
* File path - wild card supported
* IP
* URL - wild card supported
3. Select the **Trigerring IOC**.

1
windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md
View File

@ -14,7 +14,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
ms.date: 30/07/2018
---
# Create custom reports using Power BI (app authentication)

1
windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md
View File

@ -14,7 +14,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
ms.date: 30/07/2018
---
# Create custom reports using Power BI (user authentication)

1
windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md
View File

@ -14,7 +14,6 @@ manager: dansimp
audience: ITPro
ms.collection: M365-security-compliance
ms.topic: article
ms.date: 30/07/2018
---
# Advanced Hunting using Python

2
windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
View File

@ -37,7 +37,7 @@ You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evalua
## Requirements
Network protection requires Windows 10 Enterprise E3 and Windows Defender AV real-time protection.
Network protection requires Windows 10 Pro, Enterprise E3, E5 and Windows Defender AV real-time protection.
Windows 10 version | Windows Defender Antivirus
- | -

2
windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md
View File

@ -36,7 +36,7 @@ There are four steps to troubleshooting these problems:
Attack surface reduction rules will only work on devices with the following conditions:
>[!div class="checklist"]
> - Endpoints are running Windows 10 Enterprise E5, version 1709 (also known as the Fall Creators Update).
> - Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update).
> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled.
> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).

2
windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md
View File

@ -60,7 +60,7 @@ This section covers requirements for each feature in Windows Defender EG.
| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 E3 | Windows 10 E5 |
| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: |
| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) |
| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, full reporting](./images/ball_full.png) |
| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) |
| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) |
| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) |