diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d77896805e..c90eee3566 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -168,6 +168,7 @@ #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) #### [Bitlocker](policy-csp-bitlocker.md) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index b635a732a2..3c87d115e8 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -140,7 +140,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • WindowsLogon/AllowAutomaticRestartSignOn
  • WindowsLogon/ConfigAutomaticRestartSignOn
  • WindowsLogon/EnableFirstLogonAnimation
    • - + +Policy CSP - Audit +

    Added new Audit policies in Windows 10, version 1903.

    + + ApplicationControl CSP diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 360d56c02f..cb22ae437a 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -343,6 +343,188 @@ The following diagram shows the Policy configuration service provider in tree fo +### Audit policies + +
    +
    + Audit/AccountLogonLogoff_AuditAccountLockout +
    +
    + Audit/AccountLogonLogoff_AuditGroupMembership +
    +
    + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecMainMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
    +
    + Audit/AccountLogonLogoff_AuditLogoff +
    +
    + Audit/AccountLogonLogoff_AuditLogon +
    +
    + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
    +
    + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
    +
    + Audit/AccountLogonLogoff_AuditSpecialLogon +
    +
    + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
    +
    + Audit/AccountLogon_AuditCredentialValidation +
    +
    + Audit/AccountLogon_AuditKerberosAuthenticationService +
    +
    + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
    +
    + Audit/AccountLogon_AuditOtherAccountLogonEvents +
    +
    + Audit/AccountManagement_AuditApplicationGroupManagement +
    +
    + Audit/AccountManagement_AuditComputerAccountManagement +
    +
    + Audit/AccountManagement_AuditDistributionGroupManagement +
    +
    + Audit/AccountManagement_AuditOtherAccountManagementEvents +
    +
    + Audit/AccountManagement_AuditSecurityGroupManagement +
    +
    + Audit/AccountManagement_AuditUserAccountManagement +
    +
    + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
    +
    + Audit/DSAccess_AuditDirectoryServiceAccess +
    +
    + Audit/DSAccess_AuditDirectoryServiceChanges +
    +
    + Audit/DSAccess_AuditDirectoryServiceReplication +
    +
    + Audit/DetailedTracking_AuditDPAPIActivity +
    +
    + Audit/DetailedTracking_AuditPNPActivity +
    +
    + Audit/DetailedTracking_AuditProcessCreation +
    +
    + Audit/DetailedTracking_AuditProcessTermination +
    +
    + Audit/DetailedTracking_AuditRPCEvents +
    +
    + Audit/DetailedTracking_AuditTokenRightAdjusted +
    +
    + Audit/ObjectAccess_AuditApplicationGenerated +
    +
    + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
    +
    + Audit/ObjectAccess_AuditCertificationServices +
    +
    + Audit/ObjectAccess_AuditDetailedFileShare +
    +
    + Audit/ObjectAccess_AuditFileShare +
    +
    + Audit/ObjectAccess_AuditFileSystem +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformConnection +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
    +
    + Audit/ObjectAccess_AuditHandleManipulation +
    +
    + Audit/ObjectAccess_AuditKernelObject +
    +
    + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
    +
    + Audit/ObjectAccess_AuditRegistry +
    +
    + Audit/ObjectAccess_AuditRemovableStorage +
    +
    + Audit/ObjectAccess_AuditSAM +
    +
    + Audit/PolicyChange_AuditAuthenticationPolicyChange +
    +
    + Audit/PolicyChange_AuditAuthorizationPolicyChange +
    +
    + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
    +
    + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
    +
    + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
    +
    + Audit/PolicyChange_AuditPolicyChange +
    +
    + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
    +
    + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
    +
    + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
    +
    + Audit/System_AuditIPsecDriver +
    +
    + Audit/System_AuditOtherSystemEvents +
    +
    + Audit/System_AuditSecurityStateChange +
    +
    + Audit/System_AuditSecuritySystemExtension +
    +
    + Audit/System_AuditSystemIntegrity +
    +
    + ### Authentication policies
    diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..5d46a69134 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,4334 @@ +--- +title: Policy CSP - Audit +description: Policy CSP - Audit +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 09/24/2019 +--- + +# Policy CSP - Audit + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## Audit policies + +
    +
    + Audit/AccountLogonLogoff_AuditAccountLockout +
    +
    + Audit/AccountLogonLogoff_AuditGroupMembership +
    +
    + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecMainMode +
    +
    + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
    +
    + Audit/AccountLogonLogoff_AuditLogoff +
    +
    + Audit/AccountLogonLogoff_AuditLogon +
    +
    + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
    +
    + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
    +
    + Audit/AccountLogonLogoff_AuditSpecialLogon +
    +
    + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
    +
    + Audit/AccountLogon_AuditCredentialValidation +
    +
    + Audit/AccountLogon_AuditKerberosAuthenticationService +
    +
    + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
    +
    + Audit/AccountLogon_AuditOtherAccountLogonEvents +
    +
    + Audit/AccountManagement_AuditApplicationGroupManagement +
    +
    + Audit/AccountManagement_AuditComputerAccountManagement +
    +
    + Audit/AccountManagement_AuditDistributionGroupManagement +
    +
    + Audit/AccountManagement_AuditOtherAccountManagementEvents +
    +
    + Audit/AccountManagement_AuditSecurityGroupManagement +
    +
    + Audit/AccountManagement_AuditUserAccountManagement +
    +
    + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
    +
    + Audit/DSAccess_AuditDirectoryServiceAccess +
    +
    + Audit/DSAccess_AuditDirectoryServiceChanges +
    +
    + Audit/DSAccess_AuditDirectoryServiceReplication +
    +
    + Audit/DetailedTracking_AuditDPAPIActivity +
    +
    + Audit/DetailedTracking_AuditPNPActivity +
    +
    + Audit/DetailedTracking_AuditProcessCreation +
    +
    + Audit/DetailedTracking_AuditProcessTermination +
    +
    + Audit/DetailedTracking_AuditRPCEvents +
    +
    + Audit/DetailedTracking_AuditTokenRightAdjusted +
    +
    + Audit/ObjectAccess_AuditApplicationGenerated +
    +
    + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
    +
    + Audit/ObjectAccess_AuditCertificationServices +
    +
    + Audit/ObjectAccess_AuditDetailedFileShare +
    +
    + Audit/ObjectAccess_AuditFileShare +
    +
    + Audit/ObjectAccess_AuditFileSystem +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformConnection +
    +
    + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
    +
    + Audit/ObjectAccess_AuditHandleManipulation +
    +
    + Audit/ObjectAccess_AuditKernelObject +
    +
    + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
    +
    + Audit/ObjectAccess_AuditRegistry +
    +
    + Audit/ObjectAccess_AuditRemovableStorage +
    +
    + Audit/ObjectAccess_AuditSAM +
    +
    + Audit/PolicyChange_AuditAuthenticationPolicyChange +
    +
    + Audit/PolicyChange_AuditAuthorizationPolicyChange +
    +
    + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
    +
    + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
    +
    + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
    +
    + Audit/PolicyChange_AuditPolicyChange +
    +
    + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
    +
    + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
    +
    + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
    +
    + Audit/System_AuditIPsecDriver +
    +
    + Audit/System_AuditOtherSystemEvents +
    +
    + Audit/System_AuditSecurityStateChange +
    +
    + Audit/System_AuditSecuritySystemExtension +
    +
    + Audit/System_AuditSystemIntegrity +
    +
    + + +
    + + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + +Volume: Low. + + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + +Volume: High. + + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + +Volume: Medium or High on NPS and IAS server. No volume on other computers. + + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). + +Volume: Low. + + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + +Volume: High on domain controllers. + + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + +Volume: High on Kerberos Key Distribution Center servers. + + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +> [!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Distribution Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. + +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + +Volume: High. + + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + +Volume: High on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + +Volume: High on domain controllers only. + + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + +>[!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + +Volume: Low. + + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + +Volume: Low. + + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + +Volume: High on RPC servers. + + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. + +Volume: High. + + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. + +Volume: Depends on the applications that are generating them. + + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + +Volume: Medium or Low on computers running Active Directory Certificate Services. + + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + +Volume: Depends on how the file system SACLs are configured. + + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + +Volume: High. + + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + +Volume: Depends on how SACLs are configured. + + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + +Volume: High if auditing access of global system objects is enabled. + + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. + +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. + +Volume: Depends on how registry SACLs are configured. + + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). + + + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + +Volume: Low. + + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. + +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + +Volume: Very High. + + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Not used. + + + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + +Volume: High. + + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
    + + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + +Volume: Low. + + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. + + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
    + + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark6check mark6check mark6check mark6
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. + +Volume: Low. + + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + +
    + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index bd4b7bcb8f..c4c5c90156 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1040,7 +1040,7 @@ ADMX Info: -Added in Windows 10, version 1903. +Added in Windows 10, version 1903. > [!NOTE] > Currently, this policy is supported only in HoloLens 2. diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 5178fde6ad..9f94df5b29 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -68,6 +69,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    + diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a6705b085d..6d6d7771bc 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,10 +65,10 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    + - @@ -99,10 +99,10 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		September 26, 2019
    10:00 AM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:08 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		September 19, 2019
    04:58 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

    See details >    		N/A

    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected.

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

    See details >    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

    See details >    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		September 10, 2019
    10:00 AM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4512941    		August 30, 2019
    10:00 AM PT
    + -
    DetailsOriginating updateStatusHistory
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4517211.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    KB4517211    		Resolved:
    September 26, 2019
    10:00 AM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    IME may become unresponsive or have High CPU usage
    Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

    Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
    1. Select the Start button and type Services.
    2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
    3. Locate Startup type: and change it to Manual
    4. Select Ok
    5. The TabletInputService service is now in the default configuration and IME should work as expected.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:08 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Some users report issues related to the Start menu and Windows Desktop Search
    Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Resolved
    		Resolved:
    September 19, 2019
    04:58 PM PT

    Opened:
    September 11, 2019
    05:18 PM PT
    Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
    Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

    To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.

    Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		N/A

    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Audio in games is quiet or different than expected
    Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To mitigate the issue, open settings in the impacted game and disable multi-channel audio, if this option is available. You can also search in the Windows Control Panel for 3rd party audio device control panels and disable Multi-channel audio or Virtual Surround Sound, if these options are available.  

    Next steps: We are working on a resolution and estimates a solution will be available in late September.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4515384    		Mitigated
    		Last updated:
    September 13, 2019
    05:25 PM PT

    Opened:
    September 13, 2019
    05:25 PM PT
    Screenshots and Snips have an unnatural orange tint
    When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: None
    Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

    Back to top    		OS Build 18362.356

    September 10, 2019
    KB4516115    		Resolved External
    		Last updated:
    September 11, 2019
    08:54 PM PT

    Opened:
    September 11, 2019
    08:54 PM PT
    Windows Desktop Search may not return any results and may have high CPU usage
    Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

    Affected platforms:
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4515384.

    Back to top    		OS Build 18362.329

    August 30, 2019
    KB4512941    		Resolved
    KB4515384    		Resolved:
    September 10, 2019
    10:00 AM PT

    Opened:
    September 04, 2019
    02:25 PM PT
    diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index a3fe4bad82..88e7011cee 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -61,7 +61,6 @@ sections: text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    -
    SummaryOriginating updateStatusLast updated
    You may receive an error when opening or using the Toshiba Qosmio AV Center
    Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

    See details >    		August 13, 2019
    KB4512506    		Resolved
    KB4516048    		September 24, 2019
    10:00 AM PT
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

    See details >    		August 13, 2019
    KB4512506    		Resolved External
    		August 27, 2019
    02:29 PM PT
    IA64 and x64 devices may fail to start after installing updates
    After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

    See details >    		August 13, 2019
    KB4512506    		Mitigated
    		August 17, 2019
    12:59 PM PT
    " @@ -87,7 +86,6 @@ sections: - type: markdown text: " -
    DetailsOriginating updateStatusHistory
    Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
    Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

    Back to top    		August 13, 2019
    KB4512506    		Resolved External
    		Last updated:
    August 27, 2019
    02:29 PM PT

    Opened:
    August 13, 2019
    10:05 AM PT
    IA64 and x64 devices may fail to start after installing updates
    IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
    \"File: \\Windows\\system32\\winload.efi
    Status: 0xc0000428
    Info: Windows cannot verify the digital signature for this file.\"

    Affected platforms:
    • Client: Windows 7 SP1
    • Server: Windows Server 2008 R2 SP1
    Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

    Back to top    		August 13, 2019
    KB4512506    		Mitigated
    		Last updated:
    August 17, 2019
    12:59 PM PT

    Opened:
    August 13, 2019
    08:34 AM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index 54f29148ec..06dc6d0c37 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -50,7 +50,8 @@ sections: text: " - + + @@ -94,48 +95,5 @@ Given the potential impact to customers and their businesses, we have also relea For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    MessageDate
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation for this vulnerability is available from the Microsoft Security Update Guide. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. For more information about the vulnerability, see the Microsoft Security Guide: CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions, IT admins using WSUS can import this update into WSUS/SCCM manually. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    September 2019 Windows 10, version 1903 \"D\" optional release is available
    The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 26, 2019
    08:00 AM PT
    Advisory: Scripting Engine Memory Corruption Vulnerability (CVE-2019-1367)
    On September 23, 2019, Microsoft released a security update to address a remote code execution vulnerability in the way the scripting engine handles objects in memory in Internet Explorer. An attacker who successfully exploited the vulnerability could gain the same user permissions as the current user. For example, if a user is logged on with administrative rights, an attacker could take control of an affected system and install programs; view, change, or delete data; or create new accounts with full user rights. Alternatively, an attacker could host a specially crafted website targeting Internet Explorer and then entice a user to open web page or a malicious document attached to an e-mail. For more information about the vulnerability, see the Microsoft Security Guide CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. 
     
    Mitigation and more information for this vulnerability is available from the Microsoft Security Update Guide at CVE-2019-1367 | Scripting Engine Memory Corruption Vulnerability. For the best protection, we recommend you apply the latest Windows updates and follow security best practices and do not open attachments or documents from an untrusted source. 

    Update: Starting September 24, 2019, mitigation for this vulnerability is included as part of the 9C optional update, via Windows Update (WU) and Microsoft Update Catalog, for all supported versions of Windows 10, with the exception of Windows 10, version 1903 and Windows 10, version 1507 (LTSB). For devices running Windows 10, version 1903, mitigation for this vulnerability will be included as part of the 9D optional update via WU, WSUS and the Microsoft Update Catalog (targeted for September 26, 2019.) To apply this update, go to Settings > Windows Update > Check for Updates. (Note Because this update requires a reboot, we are making it optional to give customers and administrators a choice to install/deploy the update now.) 

    For customers running Windows 8.1/ Windows Server 2012 R2 or below, the 9C update is also available on Windows Server Update Services (WSUS). For other supported versions of Windows, IT admins using WSUS can import this update into WSUS/SCCM manually from Microsoft Update Catalog. See instructions on the WSUS and the Catalog Site.
    		September 24, 2019
    05:00 PM PT
    Status update: September 2019 Windows \"C\" optional release available
    The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 24, 2019
    08:10 AM PT
    Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
    Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
    		September 24, 2019
    08:00 AM PT
    Status of September 2019 “C” release
    The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
    		September 19, 2019
    04:11 PM PT
    May 10, 2019
    10:00 AM PT
    Take action: Install servicing stack update for Windows Server 2008 SP2 for SHA-2 code sign support
    A standalone update, KB4493730, that introduce SHA-2 code sign support for the servicing stack (SSU) was released today as a security update.    		April 19, 2019
    10:00 AM PT
    The benefits of Windows 10 Dynamic Update
    Dynamic Update can help organizations and end users alike ensure that their Windows 10 devices have the latest feature update content (as part of an in-place upgrade)—and preserve precious features on demand (FODs) and language packs (LPs) that may have been previously installed.

    - -
    Find out which components are updated by Dynamic Update, how Dynamic Update is initiated, and how to enable or disable it.
    		April 17, 2019
    11:26 AM PT
    Improvements to the Windows 10 update experience are coming
    Find out about the changes coming to the Windows update process that will improve the experience, offer users more control, and improve the quality of Windows updates.    		April 04, 2019
    09:00 AM PT
    Take action: review your Windows Update for Business deferral values
    If devices under your management are still running Windows 10 Pro or Windows 10 Pro for Workstations, version 1709, your devices will reach end of service on April 9, 2019 if you have configured both of the following Windows Update for Business policies:
    -
      -
    • Branch readiness is configured as Semi-Annual Channel (SAC)
      • -
    • Feature update deferral is configured as 274 days or more
      • -
    -In order avoid this, you need to set your feature update deferral policy to 273 days or less.
    		April 03, 2019
    05:47 PM PT
    Find a list of currently supported versions and previous releases
    Every Windows product has a lifecycle. The lifecycle begins when a product is released and ends when it is no longer serviced or supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade, or make other changes to your software. Check out the updated Windows 10 release information page for a list of current versions by servicing option as well as end of service dates.    		March 28, 2019
    02:00 PM PT
    Windows 10, version 1809 designated for broad deployment
    Based on the data and the feedback we’ve received from consumers, OEMs, ISVs, partners, and commercial customers, Windows 10, version 1809 has transitioned to broad deployment. With this, the Windows 10 release information page will now reflect Semi-Annual Channel (SAC) for version 1809.    		March 28, 2019
    10:00 AM PT
    Reminder: Additional servicing for the Windows 10 Enterprise, Education, and IoT Enterprise, version 1607 ends April 9, 2019
    The additional servicing for Windows 10 Enterprise, Education, and IoT Enterprise editions ends on April 9, 2019 and doesn't extend beyond this date. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Devices running Windows 10 Enterprise 2016 LTSB will continue to receive updates until October 2026 per the Fixed Lifecycle Policy. Windows 10, version 1607 devices running the Intel “Clovertrail” chipset will continue to receive updates until January 2023.
    		March 12, 2019
    10:00 AM PT
    Reminder: Windows 10 Home, Pro, Pro for Workstations, and IoT Core, version 1709 will reach end of service on April 9, 2019
    Windows 10, version 1709, will reach end of service on April 9, 2019 for devices running Windows 10 Home, Pro, Pro for Workstations, and IoT Core editions. These devices will no longer receive monthly security and quality updates that contain protection from the latest security threats. To continue receiving security and quality updates, Microsoft recommends updating to the latest version of Windows 10.

    Windows 10 Enterprise, Education, and IoT Enterprise editions will continue to receive servicing for 12 months at no cost per the lifecycle announcement on October 2018.
    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone security updates to introduce SHA-2 code sign support for Windows 7 amd Windows Server 2008 R2
    A standalone SHA-2 code signing support update for Windows Server 2008 R2 and Windows 7 is now available, as is a servicing stack update for Windows 7 SP1 and Windows Server 2008 R2 SP1 that includes the SHA-2 code signing support update.    		March 12, 2019
    10:00 AM PT
    Take action: Install standalone update for WSUS 3.0 SP2 to support the delivery of SHA-2 signed updates
    A standalone update, KB4484071 is available on Windows Update Catalog for WSUS 3.0 SP2 that supports delivering SHA-2 signed updates. For those customers using WSUS 3.0 SP2, this update should be manually installed no later than June 18, 2019.    		March 12, 2019
    10:00 AM PT
    Reminder: Final Delta update for Windows 10, version 1607, 1703, 1709, and 1803 will be April 9, 2019
    March 12th and April 9th will be the last two Delta updates for Windows 10, version 1607, 1703, 1709, and 1803. Security and quality updates will continue to be available via the express and full cumulative update packages.    		March 12, 2019
    10:00 AM PT
    How do we measure and improve the quality of Windows?
    Measuring the quality of Windows is a complex undertaking that requires gathering a variety of diagnostic signals from millions of devices within the Windows ecosystem. In addition to rigorous internal testing, we rely heavily on the feedback provided through diagnostic data to detect and fix problems before we release new updates of Windows to the general population, and to monitor the impact of those updates after each release.

    - -
    Get insight into some of the practices we employ to measure and improve the quality of Windows.
    		March 06, 2019
    10:23 AM PT
    Getting to know the Windows update history pages
    Windows update history pages offer detailed information about each Windows update: the type of update, which operating systems it affects, the improvements and fixes included, and how to get the update. See how simple it is to use this important resource to access information for Windows 10, Windows Server 2019, and earlier versions of the Windows and Windows Server operating systems.
    		February 21, 2019
    06:37 PM PT
    Share your feedback: Windows update history
    We read every comment you leave on our update history pages, and are always looking to improve these pages and the monthly knowledge base (KB) articles that accompany each monthly update. Take our survey and let us know how we can improve our transparency further and make these more compelling and useful to you and your organization.    		February 21, 2019
    12:00 PM PT
    Plan for change: Windows Update for Business and the retirement of SAC-T
    Beginning with Windows 10, version 1903 (the next feature update for Windows 10), the Windows 10 release information page will no longer list SAC-T information for version 1903 and future feature updates. Instead, you will find a single entry for each new SAC release. In addition, if you are using Windows Update for Business, you will see new UI and behavior to reflect that there is only one release date for each SAC release. If you use System Center Configuration Manager, Windows Server Update Services (WSUS), or other management tools, there will now only be one feature update published to WSUS, and this will occur at the time of release. Learn how this change will affect Windows Business for Update customers.    		February 14, 2019
    12:00 PM PT
    Champs corner: Classifying Windows updates in common deployment tools
    If you utilize automated update deployment tools, such as Windows Server Update Services (WSUS) or System Center Configuration Manager, you likely use automatic rules to streamline the approval and deployment of Windows updates. Using the correct update classification is, therefore, an important component of your organization’s device update process. Explore the options available and how to approach it in a WSUS or Configuration Manager environment.    		February 05, 2019
    10:34 AM PT
    Update: Delta updates for Windows 10, version 1607, 1703, 1709, and 1803 will be available until April 9, 2019
    Based on customer feedback, we are extending Delta update publication for Windows 10 versions 1607, 1703, 1709, and 1803. We will continue to provide Delta updates via the Microsoft Update Catalog through April 9th, 2019, which will be the last delta update available.    		February 05, 2019
    09:00 AM PT
    Global DNS outage affecting Windows Update customers
    Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider’s global outage. A software update to the external provider’s DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored.

    - -While this was not an issue with Microsoft’s services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers.

    - -If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you.
    		January 29, 2019
    04:15 PM PT
    Application compatibility in the Windows ecosystem
    Our application ecosystem is incredibly diverse, encompassing tens of millions of applications (apps) with numerous versions, languages, architectures, services and configuration options. While our ecosystem is complex, our vision is simple. All apps on Windows devices should just work! Explore the various programs and technologies we use to improve application compatibility.    		January 15, 2019
    10:00 AM PT
    Modern desktop servicing: the year in review
    2018 was a pivotal year for the modern desktop and the servicing transformation journey we have been taking with you and your organization. In this post, John Wilcox takes a look back and recaps the progress that has been made, highlighting significant events, and provideing nsight into what 2019 has in store.    		December 19, 2018
    02:20 PM PT
    Driver quality in the Windows ecosystem
    Ensuring Windows 10 works great with all the devices and accessories our customers use is a top priority. We work closely with this broad mix of partners to test new drivers, monitor health characteristics over time, and make Windows and our ecosystem more resilient architecturally. Our goal is to ensure that all the updates and drivers we deliver to non-Insider populations are validated and at production quality (including monthly optional releases) before pushing drivers broadly to all. Explore the driver distribution chain and learn how we measure driver quality and prevent conflicts.    		December 19, 2018
    10:04 AM PT
    Introducing the Modern Desktop podcast series
    In this new podcast series, we'll explore the good, the bad, and, yes, the ugly of servicing and delivery for Windows 10 and Office 365 ProPlus. We'll talk about modern desktop management through Enterprise Mobility, security, and cloud-attached and co-managed environments. Listen to the first episode, in which we discuss monthly quality updates fpr Windows 10, the Microsoft 365 Stay Current pilot program, and interview a real customer to see how they ingest monthly updates in their organization.    		December 18, 2018
    01:00 PM PT
    Measuring Delivery Optimization and its impact to your network
    If you've familiarized yourself with the configuration options for Delivery Optimization in Windows 10, and have started to configure the settings you feel will be the best fit for your organization’s network topology, now is the time to see how well those settings are working. This article provides tips on how evaluate performance at the device level or organization level.    		December 13, 2018
    03:48 PM PT
    Windows monthly security and quality updates overview
    Today’s global cybersecurity threats are both dynamic and sophisticated, and new vulnerabilities are discovered almost every day. We focus on protecting customers from these security threats by providing security updates on a timely basis and with high quality. Find out how we deliver these critical updates on a massive scale as a key component of our ongoing Windows as a service effort.    		December 10, 2018
    10:00 AM PT
    LTSC: What is it, and when should it be used?
    With the Semi-Annual Channel, devices receive two feature updates per year, and benefit from the best performance, user experience, security, and stability. This servicing option continues to be our recommendation for managing Windows 10 updates; however, we acknowledge that certain devices and use cases (e.g. medical systems and industrial process controllers) dictate that functionality and features don’t change over time. Find out how we designed the Long-Term Servicing Channel (LTSC) with these types of use cases in mind, and what is offered through the LTSC.    		November 29, 2018
    07:02 PM PT
    Plan for change: Local Experience Packs: What are they and when should you use them?
    When we released Windows 10, version 1803, we introduced Local Experience Packs (LXPs), which are modern language packs delivered through the Microsoft Store or Microsoft Store for Business. Learn about the biggest advantage to LXPs, and the retirement of legacy language packs (lp.cab) for all Language Interface Packs (LIP).    		November 14, 2018
    11:10 AM PT
    Windows 10 Quality approach for a complex ecosystem
    While our measurements of quality show improving trends on aggregate for each successive Windows 10 release, if a single customer experiences an issue with any of our updates, we take it seriously. In this blog post, Windows CVP Mike Fortin shares an overview of how we work to continuously improve the quality of Windows and our Windows as a service approach. This blog will be the first in a series of more in-depth explanations of the work we do to deliver quality in our Windows releases.    		November 13, 2018
    10:00 AM PT
    Windows 10, version 1809 rollout resumes; now available on VLSC
    Today we are resuming the rollout of the latest Windows 10 feature update—Windows 10, version 1809—via the Software Download Center (via Update Assistant or the Media Creation Tool), Windows Server Update Services (WSUS), and Windows Update for Business. Windows 10, version 1809 is also now available on the Volume Licensing Service Center (VLSC).    		November 13, 2018
    10:00 AM PT
    Express updates for Windows Server 2016 re-enabled for November 2018 update
    Starting with the November 13, 2018 Update Tuesday release, Windows will again publish Express updates for Windows Server 2016. That means that system administrators for WSUS and System Center Configuration Manager will once again see two packages for the Windows Server 2016 update: a Full update and an Express update. Read this article for more details.    		November 12, 2018
    03:00 PM PT
    Plan for change: 2019 SHA-2 code signing support requirement for Windows and WSUS
    To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

    Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Please make note of the dates in the migration timeline and plan accordingly.
    		November 09, 2018
    10:00 AM PT
    " diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 0707268a3a..b57d24fd11 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -60,6 +60,9 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). + > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 7da16a125c..4fd47f3d99 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author macaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md index c9543f40e7..08ab2a0d71 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md @@ -61,6 +61,9 @@ You can also delete tags from this view. >- Windows Server, version 1803 or later >- Windows Server 2016 >- Windows Server 2012 R2 +>- Windows Server 2008 R2 SP1 +>- Windows 8.1 +>- Windows 7 SP1 Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index e3142e03ef..ba4afb804d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -48,11 +48,11 @@ Download the installation and onboarding packages from Windows Defender Security Extract the contents of the .zip files: ```bash - ls -l + $ ls -l total 721152 -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py ``` @@ -92,7 +92,7 @@ If you did not enable Microsoft's driver during installation, then the applicati You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : false realTimeProtectionEnabled : true @@ -112,7 +112,7 @@ In this case, you need to perform the following steps to enable Real-Time Protec 1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - sudo kextutil /Library/Extensions/wdavkext.kext + $ sudo kextutil /Library/Extensions/wdavkext.kext Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } Diagnostics for /Library/Extensions/wdavkext.kext: @@ -125,13 +125,13 @@ In this case, you need to perform the following steps to enable Real-Time Protec 4. In Terminal, install the driver again. This time the operation will succeed: ```bash -sudo kextutil /Library/Extensions/wdavkext.kext +$ sudo kextutil /Library/Extensions/wdavkext.kext ``` The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: ```bash -mdatp --health +$ mdatp --health ... realTimeProtectionAvailable : true realTimeProtectionEnabled : true @@ -145,20 +145,20 @@ realTimeProtectionEnabled : true The client machine is not associated with orgId. Note that the *orgId* attribute is blank. ```bash - mdatp --health orgId + $ mdatp --health orgId ``` 2. Run the Python script to install the configuration file: ```bash - /usr/bin/python WindowsDefenderATPOnboarding.py + $ /usr/bin/python WindowsDefenderATPOnboarding.py Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) ``` 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: ```bash - mdatp --health orgId + $ mdatp --health orgId E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 21be43c179..1abf3471f5 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -50,28 +50,29 @@ Download the installation and onboarding packages from Microsoft Defender Securi Extract the contents of the .zip files: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721688 -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` 7. Make IntuneAppUtil an executable: - ```mavel-macmini:Downloads test$ chmod +x IntuneAppUtil``` + ```bash + $ chmod +x IntuneAppUtil + ``` 8. Create the wdav.pkg.intunemac package from wdav.pkg: ```bash - mavel-macmini:Downloads test$ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" Microsoft Intune Application Utility for Mac OS X Version: 1.0.0.0 Copyright 2018 Microsoft Corporation diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 9a52b56369..621dee60a6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -51,17 +51,16 @@ Download the installation and onboarding packages from Windows Defender Security 5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: ```bash - mavel-macmini:Downloads test$ ls -l + $ ls -l total 721160 -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - mavel-macmini:Downloads test$ unzip WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators inflating: intune/kext.xml inflating: intune/WindowsDefenderATPOnboarding.xml inflating: jamf/WindowsDefenderATPOnboarding.plist - mavel-macmini:Downloads test$ ``` ## Create JAMF policies @@ -166,7 +165,7 @@ Once the policy is applied, you'll see the Microsoft Defender ATP icon in the ma You can monitor policy installation on a device by following the JAMF log file: ```bash - mavel-mojave:~ testuser$ tail -f /var/log/jamf.log + $ tail -f /var/log/jamf.log Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV @@ -179,7 +178,7 @@ You can monitor policy installation on a device by following the JAMF log file: You can also check the onboarding status: ```bash -mavel-mojave:~ testuser$ mdatp --health +$ mdatp --health ... licensed : true orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" @@ -195,7 +194,7 @@ orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash -mdatp --health healthy +$ mdatp --health healthy ``` The above command prints "1" if the product is onboarded and functioning as expected. @@ -219,6 +218,8 @@ Create a script in **Settings > Computer Management > Scripts**. This script removes Microsoft Defender ATP from the /Applications directory: ```bash + #!/bin/bash + echo "Is WDAV installed?" ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index ffa0df06d3..80ec6a0f67 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -66,7 +66,7 @@ Whether real-time protection (scan files as they are accessed) is enabled or not Whether the antivirus engine runs in passive mode or not. In passive mode: - Real-time protection is turned off -- On demand scanning is turned on +- On-demand scanning is turned on - Automatic threat remediation is turned off - Security intelligence updates are turned on - Status menu icon is hidden @@ -149,6 +149,16 @@ Used to exclude content from the scan by file name. | **Possible values** | any string | | **Comments** | Applicable only if *$type* is *excludedFileName* | +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + #### Threat type settings The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. @@ -243,7 +253,7 @@ The *userInterface* section of the configuration profile is used to manage the p #### Show / hide status menu icon -Whether the status menu icon (shown in the top right corner of the screen) is hidden or not. +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. ||| |:---|:---| @@ -425,7 +435,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings @@ -540,7 +550,7 @@ The following configuration profile contains entries for all settings described allowedThreats - eicar + EICAR-Test-File (not a virus) threatTypeSettings diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index e8697f63a3..2f67653ec0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -31,7 +31,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 1. Increase logging level: ```bash - mdatp --log-level verbose + $ mdatp --log-level verbose Creating connection to daemon Connection established Operation succeeded @@ -39,10 +39,10 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem -3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. ```bash - mdatp --diagnostic --create + $ sudo mdatp --diagnostic --create Creating connection to daemon Connection established ``` @@ -50,7 +50,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 4. Restore logging level: ```bash - mdatp --log-level info + $ mdatp --log-level info Creating connection to daemon Connection established Operation succeeded @@ -82,13 +82,13 @@ Important tasks, such as controlling product settings and triggering on-demand s |-------------|-------------------------------------------|-----------------------------------------------------------------------| |Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | |Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | -|Configuration|Turn on/off product diagnostics |`mdatp --config diagnostic [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | |Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | |Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| |Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | |Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| |Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | |Health |Check the product's health |`mdatp --health` | |Protection |Scan a path |`mdatp --scan --path [path]` | |Protection |Do a quick scan |`mdatp --scan --quick` | diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index 7c18dc31d2..f87f5332c7 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -69,7 +69,7 @@ To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/ap If you prefer the command line, you can also check the connection by running the following command in Terminal: ```bash -curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' ``` The output from this command should be similar to the following: