Merge pull request #3106 from MicrosoftDocs/FromPrivateRepo

From private repo

.openpublishing.redirection.json

@@ -6,6 +6,11 @@
 "redirect_document_id": true
 },
 {
+"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md",
+"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np",
+"redirect_document_id": true
+},
+{
 "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md",
 "redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
 "redirect_document_id": true

windows/deployment/upgrade/upgrade-readiness-deployment-script.md

@@ -17,7 +17,7 @@ To automate the steps provided in [Get started with Upgrade Readiness](upgrade-r
 >[!IMPORTANT]
 >Upgrade Readiness was previously called Upgrade Analytics. References to Upgrade Analytics in any scripts or online content pertain to the Upgrade Readiness solution.
 
-For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics/2016/09/20/new-version-of-the-upgrade-analytics-deployment-script-available/).
+For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/New-version-of-the-Upgrade-Analytics-Deployment-Script-available/ba-p/187164?advanced=false&collapse_discussion=true&q=new%20version%20of%20the%20upgrade%20analytics%20deployment%20script%20available&search_type=thread).
 
 > The following guidance applies to version 11.11.16 or later of the Upgrade Readiness deployment script. If you are using an older version, download the latest from the [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409).
 

windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md

@@ -1,65 +0,0 @@
----
-title: Submit cab files related to problems
-description: Use the command-line tool to obtain .cab file that can be used to investigate ASR rule issues.
-keywords: troubleshoot, error, fix, asr, windows defender eg, exploit guard, attack surface reduction
-search.product: eADQiWindows 10XVcnh
-ms.pagetype: security
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: medium
-author: andreabichsel
-ms.author: v-anbic
-ms.date: 08/08/2018
----
-
-# Collect diagnostic data for file submissions
-
-**Applies to:**
-
-- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
-
-This topic describes how to collect diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues you may encounter when using attack surface reduction rules, network protection, exploit protection, and controlled folder access. 
-
-In particular, you will be asked to collect and attach this data when using the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) if you indicate that you have encountered a problem with [attack surface reduction rules](attack-surface-reduction-exploit-guard.md) or [network protection](network-protection-exploit-guard.md).
-
-Before attempting this process, ensure you have met all required pre-requisites and taken any other suggested troubleshooting steps as described in these topics:
-- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md) 
-- [Troubleshoot network protection](troubleshoot-np.md) 
-
-
-
-1. On the endpoint with the issue, obtain the Windows Defender .cab diagnostic file by following this process:
-
-    1. Open an administrator-level version of the command prompt:
-        
-        1. Open the **Start** menu.
-        
-        2. Type **cmd**. Right-click on **Command Prompt** and click **Run as administrator**.
-        
-        3. Enter administrator credentials or approve the prompt.
-        
-    2. Navigate to the Windows Defender directory. By default, this is C:\Program Files\Windows Defender, as in the following example:
-        
-        ```console
-        cd c:\program files\windows defender
-        ```
-    
-    3. Enter the following command and press **Enter**
-        
-        ```console
-        mpcmdrun -getfiles
-        ```
-    
-    4. A .cab file will be generated that contains various diagnostic logs. The location of the file will be specified in the output in the command prompt, but by default it will be in C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
-
-2. Attach this .cab file to the submission form where indicated.
-
-
-## Related topics
-
-- [Troubleshoot attack surface reduction rules](troubleshoot-asr.md) 
-- [Troubleshoot network protection](troubleshoot-np.md) 
-
-

windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md

@@ -11,6 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
+ms.date: 03/29/2019
 ---
 
 # Enable controlled folder access
@@ -21,11 +22,15 @@ ms.author: v-anbic
 
 [Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients.
 
-This topic describes how to enable Controlled folder access with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). 
+You can enable controlled folder access by using any of the these methods:
 
-## Enable and audit controlled folder access
+- Windows Security app
+- Intune 
+- MDM
+- Group Policy
+- PowerShell cmdlets
 
-You can enable controlled folder access with the Security Center app, Group Policy, PowerShell, or MDM CSPs. You can also set the feature to audit mode. Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
+ Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.
 
 >[!NOTE]
 >The Controlled folder access feature will display the state in the Windows Security app under **Virus & threat protection settings**.
@@ -38,7 +43,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
 >- System Center Endpoint Protection **Allow users to add exclusions and overrides**
 >For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged).
 
-## Windows Security app to enable controlled folder access
+## Windows Security app
 
 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
 
@@ -46,8 +51,23 @@ You can enable controlled folder access with the Security Center app, Group Poli
 
 3. Set the switch for **Controlled folder access** to **On**.
 
+## Intune
 
-### Use Group Policy to enable Controlled folder access
+1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
+1. Click **Device configuration** > **Profiles** > **Create profile**.
+1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
+   ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) 
+1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. 
+1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**. 
+   ![Enable controlled folder access in Intune](images/enable-cfa-intune.png)
+1. Click **OK** to save each open blade and click **Create**. 
+1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
+
+## MDM 
+
+Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. 
+
+## Group Policy
 
 1.  On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
 
@@ -65,7 +85,7 @@ You can enable controlled folder access with the Security Center app, Group Poli
 >[!IMPORTANT]
 >To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu.
 
-### Use PowerShell to enable controlled folder access
+## PowerShell
 
 1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**.
 
@@ -79,10 +99,6 @@ You can enable the feature in audit mode by specifying `AuditMode` instead of `E
 
 Use `Disabled` to turn the feature off.
 
-### Use MDM CSPs to enable controlled folder access
-
-Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. 
-
 ## Related topics
 
 - [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md)

windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 03/26/2019
+ms.date: 03/29/2019
 ---
 
 # Enable exploit protection
@@ -26,17 +26,22 @@ Many features from the Enhanced Mitigation Experience Toolkit (EMET) are include
 
 You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine.
 
-## Enable exploit protection
+You can enable each mitigation separately by using any of the these methods:
+
+- Windows Security app
+- Intune 
+- MDM
+- Group Policy
+- PowerShell cmdlets
 
-You enable and configure each exploit protection mitigation separately either by using the Windows Security app or PowerShell.
 They are configured by default in Windows 10. 
 
 You can set each mitigation to on, off, or to its default value. 
 Some mitigations have additional options.
 
-You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy it to other machines by using Group Policy. 
+You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other machines. 
 
-### Windows Security app
+## Windows Security app
 
 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
 
@@ -103,9 +108,33 @@ CFG will be enabled for *miles.exe*.
 
 5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration.
 
+## Intune
 
+1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
+1. Click **Device configuration** > **Profiles** > **Create profile**.
+1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
+   ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) 
+1. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**.  
+1. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings:  
+   ![Enable network protection in Intune](images/enable-ep-intune.png)
+1. Click **OK** to save each open blade and click **Create**. 
+1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
 
-### PowerShell
+## MDM
+
+Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) configuration service provider (CSP) to enable or disable exploit protection mitigations or to use audit mode.
+
+## Group Policy
+
+1.  On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
+
+1.  In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
+
+1.  Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**.
+
+6. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**.
+
+## PowerShell
 
 You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
 

windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md

@@ -1,5 +1,5 @@
 ---
-title: Turn network protection on
+title: Turn on network protection 
 description: Enable Network protection with Group Policy, PowerShell, or MDM CSPs
 keywords: ANetwork protection, exploits, malicious website, ip, domain, domains, enable, turn on
 search.product: eADQiWindows 10XVcnh
@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 03/27/2019
+ms.date: 03/28/2019
 ---
 
 # Enable network protection
@@ -24,14 +24,26 @@ ms.date: 03/27/2019
 You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it.  
 You can enable network protection by using any of the these methods:
 
+- Intune 
 - MDM
 - Group Policy
 - PowerShell cmdlets
+- Registry
 
+## Intune
+
+1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune.
+1. Click **Device configuration** > **Profiles** > **Create profile**.
+1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**.
+   ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) 
+1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**.  
+   ![Enable network protection in Intune](images/enable-np-intune.png)
+1. Click **OK** to save each open blade and click **Create**. 
+1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**.
 
 ## MDM
 
-Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable and configure network protection.
+Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection) configuration service provider (CSP) to enable or disable network protection or enable audit mode.
 
 ## Group Policy 
 
@@ -68,6 +80,16 @@ Set-MpPreference -EnableNetworkProtection AuditMode
 
 Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
 
+## 
+
+Network protection can't be turned on using the Windows Security app, but you can enable it by using Registry editor.
+
+1. Click **Start** and type **regedit** to open **Registry Editor**.
+1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection
+1. Set the value: 
+   0=off
+   1=on
+   2=audit
 
 ## Related topics
 

windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 11/16/2018
+ms.date: 03/27/2019
 ---
 
 # Evaluate network protection
@@ -22,71 +22,46 @@ ms.date: 11/16/2018
 
 Network protection helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet.
 
-This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site.
+This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site. The site in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious. The site will replicate the behavior that would happen if a user visted a malicious site or domain.
 
->[!NOTE]
->The site will replicate the behavior that would happen if a user visted a malicious site or domain. The sites in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious.
 
 >[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
+>You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work.
 
-## Enable network protection
+## Enable network protection in audit mode
+
+You can enable network protection in audit mode to see which IP addresses and domains would have been blocked if it was enabled.
+
+You might want to do this to make sure it doesn't affect line-of-business apps or to get an idea of how often blocks occur.
 
 1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
 2. Enter the following cmdlet:
 
     ```PowerShell
-    Set-MpPreference -EnableNetworkProtection Enabled
+    Set-MpPreference -EnableNetworkProtection AuditMode
     ```
 
-You can also carry out the processes described in this topic in audit or disabled mode to see how the feature will work. Use the same PowerShell cmdlet as above, but replace "Enabled" with either "AuditMode" or "Disabled".
-
 ### Visit a (fake) malicious domain
 
 1. Open Internet Explorer, Google Chrome, or any other browser of your choice.
 
 1. Go to [https://smartscreentestratings2.net](https://smartscreentestratings2.net).
 
-You will get a 403 Forbidden response in the browser, and you will see a notification that the network connnection was blocked.
+The network connection will be allowed and a test message will be displayed.
 
 ![Example notification that says Connection blocked: Your IT administrator caused Windows Security to block this network connection. Contact your IT help desk.](images/np-notif.png)
  
 ## Review network protection events in Windows Event Viewer
  
-You can also review the Windows event log to see the events there were created when performing the demo. You can use the custom view below or [locate them manually](event-views-exploit-guard.md#list-of-attack-surface-reduction-events).
+To review apps that would have been blocked, open Event Viewer and filter for Event ID 1125 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events.
 
-1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
-
-2. On the left panel, under **Actions**, click **Import custom view...**
-
-3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
-
-4. Click **OK**.
-
-5. This will create a custom view that filters to only show the following events related to network protection:
-
-Event ID | Description
+Event ID | Provide/Source | Description
 -|-
-5007 | Event when settings are changed
-1125 | Event when rule fires in audit mode 
-1126 | Event when rule fires in block mode 
+5007 | Windows Defender (Operational) | Event when settings are changed
+1125 | Windows Defender (Operational) | Event when a network connection is audited
+1126 | Windows Defender (Operational) | Event when a network connection is blocked 
 
 
-## Use audit mode to measure impact
-
-You can also enable the network protection feature in audit mode. This lets you see a record of which IP addresses and domains would have been blocked if the feature were enabled.
-
-You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the feature will block connections during normal use.
-
-To enable audit mode, use the following PowerShell cmdlet:
-
-```PowerShell
-Set-MpPreference -EnableNetworkProtection AuditMode
-```
->[!TIP]
->If you want to fully audit how network protection will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
-You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Network protection topic](network-protection-exploit-guard.md).
-
 ## Related topics
 
 - [Protect your network](network-protection-exploit-guard.md)

windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md

@@ -11,6 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
+ms.date: 03/27/2019
 ---
 
 # Troubleshoot attack surface reduction rules
@@ -26,12 +27,12 @@ When you use [attack surface reduction rules](attack-surface-reduction-exploit-g
 
 There are four steps to troubleshooting these problems:
 
-1. Confirm that you have met all pre-requisites
+1. Confirm prerequisites
 2. Use audit mode to test the rule
 3. Add exclusions for the specified rule (for false positives)
 3. Submit support logs
 
-## Confirm pre-requisites
+## Confirm prerequisites
 
 Attack surface reduction rules will only work on devices with the following conditions:
 
@@ -45,27 +46,14 @@ If these pre-requisites have all been met, proceed to the next step to test the
 
 ## Use audit mode to test the rule
 
-There are two ways that you can test if the rule is working. 
+You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. 
 
-You can use a pre-configured demo tool to confirm attack surface reduction rules are generally working on the device, or you can use audit mode, which enables rules for reporting only. 
+Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
 
-The demo tool uses pre-configured scenarios and processes, which can be useful to first see if the attack surface reduction rule feature as a whole is operating correctly.
-
-If you encounter problems when running the demo tool, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
-
-Follow the instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
-
->[!TIP]
->While the instructions for using the demo tool are intended for evaluating or seeing how attack surface reduction rules work, you can use it to test that the rule works on known scenarios that we have already extensively tested before we released the feature. 
-
-Audit mode allows the rule to report as if it actually blocked the file or process, but will still allow the file to run.
-
-1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
+1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run.
 2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).
 3. [Review the attack surface reductio rule event logs](attack-surface-reduction-exploit-guard.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**.
 
->[!TIP] 
->Audit mode will stop the rule from blocking the file or process. 
 >
 >If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled. 
 >
@@ -74,36 +62,39 @@ Audit mode allows the rule to report as if it actually blocked the file or proce
 If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation:
 
 1. If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
-2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data).
+2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
 
 ## Add exclusions for a false positive
 
-You can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
+If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
 
-This is useful if you have enabled a rule, and it is blocking a file, process, or action that you believe it should not block. You can then collect data from an endpoint where the rule is not working correctly and send that information to us.
-
-To add an exclusion, see the [Customize Attack surface reduction](customize-attack-surface-reduction.md) topic.
+To add an exclusion, see [Customize Attack surface reduction](customize-attack-surface-reduction.md).
 
 >[!IMPORTANT]
 >You can specify individual files and folders to be excluded, but you cannot specify individual rules.
->
 >This means any files or folders that are excluded will be excluded from all ASR rules.
 
-If you have followed all previous troubleshooting steps, and you still have a problem (in particular, if you have a false positive), you should proceed to the next step to collect diagnostic information and send it to us.
+## Report a false positive or false negative
 
-## Collect diagnostic data
+Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
 
-You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with attack surface reduction rules.
+## Collect diagnostic data for file submissions
 
-When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
+When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. 
 
-You must also attach associated files in a .zip file (such as the file or executable that is not being blocked, or being incorrectly blocked) along with a diagnostic .cab file to your submission. 
-
-Follow the link below for instructions on how to collect the .cab file:
-
-> [!div class="nextstepaction"]
-> [Collect and submit diagnostic data](collect-cab-files-exploit-guard-submission.md)
+1. Open an elevated command prompt and change to the Windows Defender directory:
+   ```console
+   cd c:\program files\windows defender
+   ```
+2. Run this command to generate the diagnostic logs:
+   ```console
+   mpcmdrun -getfiles
+   ```
+3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. 
 
 ## Related topics
 
 - [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md)
+- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
+- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)
+

windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md

@@ -29,12 +29,12 @@ When you use [Network protection](network-protection-exploit-guard.md) you may e
 
 There are four steps to troubleshooting these problems:
 
-1. Confirm that you have met all pre-requisites
+1. Confirm prerequisites
 2. Use audit mode to test the rule
 3. Add exclusions for the specified rule (for false positives)
 3. Submit support logs
 
-## Confirm pre-requisites
+## Confirm prerequisites
 
 Network protection will only work on devices with the following conditions:
 
@@ -45,48 +45,45 @@ Network protection will only work on devices with the following conditions:
 > - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled.
 > - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
 
-If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode.
 
-## Use audit mode to test the rule
+## Use audit mode 
 
-There are two ways that you can test if the feature is working - you can use a demo website, and you can use audit mode.
+You can enable network protection in audit mode and then visit a website that we've created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled. 
 
-You can enable network protection and then visit a website that we've created to demo the feature. The website will always be reported as blocked by network protection. See [Evaluate network protection](evaluate-network-protection.md) for instructions.
-
-If you encounter problems when running the evaluation scenario, check that the device you are testing the tool on meets the [pre-requisites listed above](#confirm-pre-requisites).
-
->[!TIP]
->While the instructions for using the demo website are intended for evaluating or seeing how network protection works, you can use it to test that the feature is working properly and narrow down on the cause of the problem. 
-
-You can also use audit mode and then attempt to visit the site or IP (IPv4) address you do or don't want to block. Audit mode lets network protection report to the Windows event log as if it actually blocked the site or connection to an IP address, but will still allow the file to run.
-
-1. Enable audit mode for network protection. Use Group Policy to set the rule to **Audit mode** as described in the [Enable network protection topic](enable-network-protection.md#group-policy).
+1. Set network protection to **Audit mode**.
+   ```powershell
+   Set-MpPreference -EnableNetworkProtection AuditMode
+   ```
 2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
 3. [Review the network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
-
-
->[!IMPORTANT] 
->Audit mode will stop network protection from blocking known malicious connections. 
 >
->If network protection is not blocking a connection that you are expecting it should block, first check if audit mode is enabled. 
->
->Audit mode may have been enabled for testing another feature in Windows Defender Exploit Guard, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
+>If network protection is not blocking a connection that you are expecting it should block, enable the feature.
 
-
-If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, proceed to the next section to report the site or IP address. 
+```powershell
+Set-MpPreference -EnableNetworkProtection Enabled
+```
 
 ## Report a false positive or false negative
 
-You can use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a problem with network protection.
+If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md).
 
-When you fill out the submission form, you will be asked to specify whether it is a false negative or false positive. If you have an E5 subscription for Windows Defender Advanced Threat Protection, you can also [provide a link to the associated alert](../windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) (if there is one).
+## Collect diagnostic data for file submissions
 
-You can also attach a diagnostic .cab file to your submission if you wish (this is not required). Follow the link below for instructions on how to collect the .cab file:
+When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. 
 
-> [!div class="nextstepaction"]
-> [Collect and submit diagnostic data Windows Defender Exploit Guard issues](collect-cab-files-exploit-guard-submission.md)
+1. Open an elevated command prompt and change to the Windows Defender directory:
+   ```console
+   cd c:\program files\windows defender
+   ```
+2. Run this command to generate the diagnostic logs:
+   ```console
+   mpcmdrun -getfiles
+   ```
+3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. 
 
 ## Related topics
 
 - [Windows Defender Exploit Guard](windows-defender-exploit-guard.md)
 - [Network protection](network-protection-exploit-guard.md)
+- [Evaluate network protection](evaluate-network-protection.md)
+- [Enable network protection](enable-network-protection.md)