mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Resolved merge conflicts
This commit is contained in:
ManikaDhiman
commit
d591722d51
@ -2,10 +2,9 @@
|
||||
|
||||
|
||||
|
||||
## Week of October 19, 2020
|
||||
## Week of November 30, 2020
|
||||
|
||||
|
||||
| Published On |Topic title | Change |
|
||||
|------|------------|--------|
|
||||
| 10/22/2020 | [Microsoft 365 Education Documentation for developers](/education/developers) | modified |
|
||||
| 10/22/2020 | [Windows 10 editions for education customers](/education/windows/windows-editions-for-education-customers) | modified |
|
||||
| 12/4/2020 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified |
|
||||
|
||||
@ -26,69 +26,106 @@ This guide shows you how to deploy the Windows 10 operating system in a school d
|
||||
|
||||
Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. Just as with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you will manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district.
|
||||
|
||||
>**Note** This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management).
|
||||
> [!NOTE]
|
||||
> This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management).
|
||||
|
||||
### Plan a typical district configuration
|
||||
|
||||
As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 1. Typical district configuration for this guide*
|
||||
|
||||
A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 2. Typical school configuration for this guide*
|
||||
|
||||
Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 3. Typical classroom configuration in a school*
|
||||
|
||||
This district configuration has the following characteristics:
|
||||
|
||||
* It contains one or more admin devices.
|
||||
|
||||
* It contains two or more schools.
|
||||
|
||||
* Each school contains two or more classrooms.
|
||||
|
||||
* Each classroom contains one teacher device.
|
||||
|
||||
* The classrooms connect to each other through multiple subnets.
|
||||
|
||||
* All devices in each classroom connect to a single subnet.
|
||||
|
||||
* All devices have high-speed, persistent connections to each other and to the Internet.
|
||||
|
||||
* All teachers and students have access to Microsoft Store or Microsoft Store for Business.
|
||||
|
||||
* You install a 64-bit version of Windows 10 on the admin device.
|
||||
|
||||
* You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device.
|
||||
|
||||
* You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device.
|
||||
>**Note** In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2.
|
||||
|
||||
> [!NOTE]
|
||||
> In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2.
|
||||
|
||||
* The devices use Azure AD in Office 365 Education for identity management.
|
||||
|
||||
* If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](https://azure.microsoft.com/documentation/articles/active-directory-aadconnect/).
|
||||
|
||||
* Use [Intune](https://docs.microsoft.com/intune/), [Mobile Device Management for Office 365](https://support.office.com/en-us/article/Set-up-Mobile-Device-Management-MDM-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy in AD DS](https://technet.microsoft.com/library/cc725828.aspx) to manage devices.
|
||||
|
||||
* Each device supports a one-student-per-device or multiple-students-per-device scenario.
|
||||
|
||||
* The devices can be a mixture of different make, model, and processor architecture (32-bit or 64-bit) or be identical.
|
||||
|
||||
* To initiate Windows 10 deployment, use a USB flash drive, DVD-ROM or CD-ROM, or Pre-Boot Execution Environment (PXE) boot.
|
||||
|
||||
* The devices can be a mixture of different Windows 10 editions, such as Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education.
|
||||
|
||||
Use these characteristics at a minimum as you deploy your schools. If your district deployment is less complex, you may want to review the guidance in [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school).
|
||||
|
||||
>**Note** This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution.
|
||||
> [!NOTE]
|
||||
> This guide focuses on Intune as the mobile device management (MDM) solution. If you want to use an MDM solution other than Intune, ignore the Intune-specific content in this guide. For each section, contact your MDM provider to determine the features and management capabilities for your institution.
|
||||
|
||||
Office 365 Education allows:
|
||||
|
||||
* Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser.
|
||||
|
||||
* Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students.
|
||||
|
||||
* Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, the administration, and faculty.
|
||||
|
||||
* Teachers to employ Sway to create interactive educational digital storytelling.
|
||||
|
||||
* Students and faculty to use email and calendars, with mailboxes up to 50 GB per user.
|
||||
|
||||
* Faculty to use advanced email features like email archiving and legal hold capabilities.
|
||||
|
||||
* Faculty to help prevent unauthorized users from accessing documents and email by using Microsoft Azure Rights Management.
|
||||
|
||||
* Faculty to use advanced compliance tools on the unified eDiscovery pages in the Office 365 Compliance Center.
|
||||
|
||||
* Faculty to host online classes, parent–teacher conferences, and other collaboration in Skype for Business.
|
||||
|
||||
* Students and faculty to access up to 1 TB of personal cloud storage that users inside and outside the educational institution can share through OneDrive for Business.
|
||||
|
||||
* Teachers to provide collaboration in the classroom through Microsoft SharePoint Online team sites.
|
||||
|
||||
* Students and faculty to use Office 365 Video to manage videos.
|
||||
|
||||
* Students and faculty to use Yammer to collaborate through private social networking.
|
||||
|
||||
* Students and faculty to access classroom resources from anywhere on any device (including Windows 10 Mobile, iOS, and Android devices).
|
||||
|
||||
For more information about Office 365 Education features and an FAQ, go to [Office 365 Education plans and pricing](https://products.office.com/en-us/academic).
|
||||
@ -105,7 +142,7 @@ This guide focuses on LTI deployments to deploy the reference device. You can us
|
||||
|
||||
MDT includes the Deployment Workbench, a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices.
|
||||
|
||||
LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in the [Prepare the admin device](#prepare-the-admin-device) section.
|
||||
LTI performs deployment from a *deployment share* — a network-shared folder on the device on which you installed MDT. You can perform over-the-network deployments from the deployment share or perform deployments from a local copy of the deployment share on a USB drive or DVD. You will learn more about MDT in [Prepare the admin device](#prepare-the-admin-device), earlier in this article.
|
||||
|
||||
The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements.
|
||||
|
||||
@ -114,9 +151,13 @@ ZTI performs fully automated deployments using Configuration Manager and MDT. Al
|
||||
The configuration process requires the following devices:
|
||||
|
||||
* **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the Configuration Manager Console on this device.
|
||||
|
||||
* **Reference devices.** These are the devices that you will use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices.
|
||||
|
||||
You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all).
|
||||
|
||||
* **Faculty and staff devices.** These are the devices that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices.
|
||||
|
||||
* **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them.
|
||||
|
||||
The high-level process for deploying and configuring devices within individual classrooms, individual schools, and the district as a whole is as follows and illustrated in Figure 4:
|
||||
@ -139,7 +180,8 @@ The high-level process for deploying and configuring devices within individual c
|
||||
|
||||
9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 4. How district configuration works*
|
||||
|
||||
@ -512,7 +554,8 @@ For more information about installing the Windows ADK, see [Step 2-2: Install Wi
|
||||
Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windows 10 and app deployment. It is a free tool available directly from Microsoft.
|
||||
You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems.
|
||||
|
||||
>**Note** If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system.
|
||||
> [!NOTE]
|
||||
> If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32-bit versions of the operating system.
|
||||
|
||||
For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/library/dn759415.aspx#InstallingaNewInstanceofMDT).
|
||||
|
||||
@ -526,7 +569,8 @@ For more information about how to create a deployment share, see [Step 3-1: Crea
|
||||
|
||||
### Install the Configuration Manager console
|
||||
|
||||
>**Note** If you selected Microsoft Endpoint Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next.
|
||||
> [!NOTE]
|
||||
> If you selected Microsoft Endpoint Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next.
|
||||
|
||||
You can use Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install Configuration Manager primary site servers.
|
||||
|
||||
@ -534,7 +578,8 @@ For more information about how to install the Configuration Manager console, see
|
||||
|
||||
### Configure MDT integration with the Configuration Manager console
|
||||
|
||||
>**Note** If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in the [Select the deployment methods](#select-the-deployment-methods) section, then skip this section and continue to the next.
|
||||
> [!NOTE]
|
||||
> If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in [Select the deployment methods](#select-the-deployment-methods), earlier in this article, then skip this section and continue to the next.
|
||||
|
||||
You can use MDT with Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT.
|
||||
|
||||
@ -544,7 +589,7 @@ For more information, see [Enable Configuration Manager Console Integration for
|
||||
|
||||
#### Summary
|
||||
|
||||
In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in the [Select the deployment methods](#select-the-deployment-methods) section). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console.
|
||||
In this section, you installed the Windows ADK and MDT on the admin device. You also created the MDT deployment share that you will configure and use later to capture a reference image. You can also use the MDT deployment share to deploy Windows 10 and your apps to faculty and students (if that’s the method you selected in [Select the deployment methods](#select-the-deployment-methods), earlier in this article). Finally, you installed the Configuration Manager console and configured MDT integration with the Configuration Manager console.
|
||||
|
||||
## Create and configure Office 365
|
||||
|
||||
@ -590,13 +635,19 @@ You will use the Office 365 Education license plan information you record in Tab
|
||||
|
||||
To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions.
|
||||
|
||||
>**Note** If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365).
|
||||
> [!NOTE]
|
||||
> If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Create user accounts in Office 365](#create-user-accounts-in-office-365).
|
||||
|
||||
#### To create a new Office 365 subscription
|
||||
|
||||
1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar.
|
||||
> **Note** If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods:
|
||||
> <ul><li>In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap <strong>More actions</strong>), and then click or tap <strong>New InPrivate window</strong>.<li>In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap <strong>Settings</strong>), click or tap <strong>Safety</strong>, and then click or tap <strong>InPrivate Browsing</strong>.</li></ul>
|
||||
|
||||
> [!NOTE]
|
||||
> If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods:
|
||||
>
|
||||
> - In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap <strong>More actions</strong>), and then click or tap <strong>New InPrivate window</strong>.
|
||||
>
|
||||
> - In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap <strong>Settings</strong>), click or tap <strong>Safety</strong>, and then click or tap <strong>InPrivate Browsing</strong>.
|
||||
|
||||
|
||||
2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**.
|
||||
@ -631,7 +682,8 @@ Now that you have created your new Office 365 Education subscription, add the do
|
||||
|
||||
To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant.
|
||||
|
||||
>**Note** By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
|
||||
> [!NOTE]
|
||||
> By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries/regions require opt-in steps to add new users to existing Office 365 tenants. Check your country/region requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. For more information, see [Office 365 Education Self-Sign up: Technical FAQ](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US&WT.mc_id=eml_CXM__33537_MOD_EDU_Student_Advantage_Rush).
|
||||
|
||||
Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks:
|
||||
|
||||
@ -640,7 +692,8 @@ Office 365 uses the domain portion of the user’s email address to know which O
|
||||
|
||||
You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before you allow other faculty and students to join Office 365.
|
||||
|
||||
>**Note** You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours.
|
||||
> [!NOTE]
|
||||
> You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours.
|
||||
|
||||
By default, all new Office 365 Education subscriptions have automatic tenant join enabled, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 10. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
|
||||
|
||||
@ -651,13 +704,15 @@ By default, all new Office 365 Education subscriptions have automatic tenant joi
|
||||
|
||||
*Table 10. Windows PowerShell commands to enable or disable automatic tenant join*
|
||||
|
||||
>**Note** If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant.
|
||||
> [!NOTE]
|
||||
> If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant.
|
||||
|
||||
### Disable automatic licensing
|
||||
|
||||
To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval.
|
||||
|
||||
>**Note** By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section.
|
||||
> [!NOTE]
|
||||
> By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section.
|
||||
|
||||
Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 11. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins).
|
||||
|
||||
@ -678,7 +733,7 @@ The following Azure AD Premium features are not in Azure AD Basic:
|
||||
|
||||
* Allow designated users to manage group membership
|
||||
* Dynamic group membership based on user metadata
|
||||
* Azure multifactor authentication (MFA; see [What is Azure Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/))
|
||||
* Azure AD Multi-Factor Authentication authentication (MFA; see [What is Azure AD Multi-Factor Authentication Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/))
|
||||
* Identify cloud apps that your users run
|
||||
* Self-service recovery of BitLocker
|
||||
* Add local administrator accounts to Windows 10 devices
|
||||
@ -709,9 +764,11 @@ Now that you have an Office 365 subscription, you must determine how you’ll cr
|
||||
|
||||
In this method, you have an on-premises AD DS domain. As shown in Figure 5, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD.
|
||||
|
||||
>**Note** Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx).
|
||||
> [!NOTE]
|
||||
> Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/library/dn510997.aspx).
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 5. Automatic synchronization between AD DS and Azure AD*
|
||||
|
||||
@ -721,7 +778,8 @@ For more information about how to perform this step, see the [Integrate on-premi
|
||||
|
||||
In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 6. Bulk import into Azure AD from other sources*
|
||||
|
||||
@ -742,7 +800,8 @@ In this section, you selected the method for creating user accounts in your Offi
|
||||
|
||||
You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS.
|
||||
|
||||
>**Note** If your institution does not have an on-premises AD DS domain, you can skip this section.
|
||||
> [!NOTE]
|
||||
> If your institution does not have an on-premises AD DS domain, you can skip this section.
|
||||
|
||||
### Select a synchronization model
|
||||
|
||||
@ -752,13 +811,15 @@ You can deploy the Azure AD Connect tool:
|
||||
|
||||
- **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 7. Azure AD Connect on premises*
|
||||
|
||||
- **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises.
|
||||
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
*Figure 8. Azure AD Connect in Azure*
|
||||
|
||||
@ -815,7 +876,8 @@ In this section, you selected your synchronization model, deployed Azure AD Conn
|
||||
|
||||
You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS.
|
||||
|
||||
>**Note** If your institution doesn’t have an on-premises AD DS domain, you can skip this section.
|
||||
> [!NOTE]
|
||||
> If your institution doesn’t have an on-premises AD DS domain, you can skip this section.
|
||||
|
||||
### Select the bulk import method
|
||||
|
||||
@ -823,7 +885,7 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
|
||||
|
||||
|Method |Description and reason to select this method |
|
||||
|-------|---------------------------------------------|
|
||||
|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).|
|
||||
|Ldifde.exe|This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren't comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).|
|
||||
|VBScript|This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).|
|
||||
|Windows PowerShell|This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
|
||||
|
||||
@ -845,7 +907,8 @@ After you have selected your user and group account bulk import method, you’re
|
||||
|
||||
With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method.
|
||||
|
||||
>**Note** Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts.
|
||||
> [!NOTE]
|
||||
> Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts.
|
||||
|
||||
For more information about how to import user accounts into AD DS by using:
|
||||
|
||||
@ -865,7 +928,8 @@ You can bulk-import user and group accounts directly into Office 365, reducing t
|
||||
|
||||
Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom.
|
||||
|
||||
>**Note** If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
||||
> [!NOTE]
|
||||
> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
||||
|
||||
You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users).
|
||||
|
||||
@ -873,7 +937,8 @@ The bulk-add process assigns the same Office 365 Education license plan to all u
|
||||
|
||||
For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365 - Admin help](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US).
|
||||
|
||||
>**Note** If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process.
|
||||
> [!NOTE]
|
||||
> If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process.
|
||||
|
||||
The email accounts are assigned temporary passwords on creation. You must communicate these temporary passwords to your users before they can sign in to Office 365.
|
||||
|
||||
@ -881,13 +946,15 @@ The email accounts are assigned temporary passwords on creation. You must commun
|
||||
|
||||
Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources.
|
||||
|
||||
>**Note** If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
||||
> [!NOTE]
|
||||
> If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
|
||||
|
||||
For information about creating security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
|
||||
|
||||
You can add and remove users from security groups at any time.
|
||||
|
||||
>**Note** Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect.
|
||||
> [!NOTE]
|
||||
> Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may have to sign out, and then sign in again for the change to take effect.
|
||||
|
||||
### Create email distribution groups
|
||||
|
||||
@ -895,7 +962,8 @@ Microsoft Exchange Online uses an email distribution group as a single email rec
|
||||
|
||||
You can create email distribution groups based on job role (such as teacher, administration, or student) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group.
|
||||
|
||||
>**Note** Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
||||
> [!NOTE]
|
||||
> Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until the creation process ends before you can perform the following steps.
|
||||
|
||||
|
||||
For information about creating email distribution groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
|
||||
@ -957,7 +1025,8 @@ After you create the Microsoft Store for Business portal, configure it by using
|
||||
|
||||
Now that you have created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this from the **Inventory** page in Microsoft Store for Business.
|
||||
|
||||
>**Note** Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business.
|
||||
> [!NOTE]
|
||||
> Your educational institution can now use a credit card or purchase order to pay for apps in Microsoft Store for Business.
|
||||
|
||||
You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users to install the apps.
|
||||
|
||||
@ -989,13 +1058,15 @@ Depending on your school’s requirements, you may need any combination of the f
|
||||
* Upgrade institution-owned devices to Windows 10 Education.
|
||||
* Deploy new instances of Windows 10 Education so that new devices have a known configuration.
|
||||
|
||||
>**Note** Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades).
|
||||
> [!NOTE]
|
||||
> Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades).
|
||||
|
||||
For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32-bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above.
|
||||
|
||||
>**Note** On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources.
|
||||
> [!NOTE]
|
||||
> On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources.
|
||||
|
||||
Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture.
|
||||
|
||||
@ -1173,7 +1244,8 @@ For more information about how to update a deployment share, see <a href="https:
|
||||
|
||||
### Configure Microsoft Endpoint Configuration Manager
|
||||
|
||||
>**Note** If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section.
|
||||
> [!NOTE]
|
||||
> If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section.
|
||||
|
||||
Before you can use Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure Configuration Manager to support the operating system deployment feature. If you don’t have an existing Configuration Manager infrastructure, you will need to deploy a new infrastructure.
|
||||
|
||||
@ -1228,7 +1300,8 @@ You can use Windows Deployment Services in conjunction with MDT to automatically
|
||||
|
||||
### Configure Window Deployment Services for Microsoft Endpoint Configuration Manager
|
||||
|
||||
>**Note** If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next.
|
||||
> [!NOTE]
|
||||
> If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next.
|
||||
|
||||
You can use Windows Deployment Services in conjunction with Configuration Manager to automatically initiate boot images on target devices. These boot images are Windows PE images that you use to boot the target devices, and then initiate Windows 10, app, and device driver deployment.
|
||||
|
||||
@ -1265,7 +1338,8 @@ After you deploy Windows 10 and the desktop apps to the reference device, you ca
|
||||
|
||||
You will capture multiple reference images, one for each type of device that you have in your organization. You perform the steps in this section for each image (device) that you have in your district. Use LTI in MDT to automate the deployment and capture of the reference image.
|
||||
|
||||
>**Note** You can use LTI in MDT or Configuration Manager to automate the deployment and capture of the reference image, but this guide only discusses how to use LTI in MDT to capture the reference image.
|
||||
> [!NOTE]
|
||||
> You can use LTI in MDT or Configuration Manager to automate the deployment and capture of the reference image, but this guide only discusses how to use LTI in MDT to capture the reference image.
|
||||
|
||||
### Customize the MDT deployment share
|
||||
|
||||
@ -1305,7 +1379,8 @@ To capture the reference image, run the LTI task sequence that you created in th
|
||||
|
||||
Use the Deployment Wizard to deploy Windows 10, your apps, and device drivers to the device, and then capture the .wim file. The LTI deployment process is almost fully automated: you provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated.
|
||||
|
||||
>**Note** To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section of [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/library/dn781089.aspx#Anchor_6).
|
||||
> [!NOTE]
|
||||
> To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section of [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/library/dn781089.aspx#Anchor_6).
|
||||
|
||||
In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems.
|
||||
|
||||
@ -1350,7 +1425,8 @@ You also want to deploy apps and software updates after you deploy Windows 10. Y
|
||||
|
||||
Microsoft has several recommended settings for educational institutions. Table 17 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 17 and evaluate their relevancy to your institution.
|
||||
|
||||
>**Note** The settings for Intune in Table 17 also apply to the Configuration Manager and Intune management (hybrid) method.
|
||||
> [!NOTE]
|
||||
> The settings for Intune in Table 17 also apply to the Configuration Manager and Intune management (hybrid) method.
|
||||
|
||||
Use the information in Table 17 to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings.
|
||||
|
||||
@ -1517,7 +1593,8 @@ You can use Microsoft Endpoint Configuration Manager to deploy Microsoft Store
|
||||
|
||||
For example, you could create a Skype application that contains a deployment type for Windows 10 desktop, Windows 10 Mobile, iOS, and Android. You can deploy the one application to multiple device types.
|
||||
|
||||
>**Note** When you configure Configuration Manager and Intune in a hybrid model, you deploy apps by using Configuration Manager as described in this section.
|
||||
> [!NOTE]
|
||||
> When you configure Configuration Manager and Intune in a hybrid model, you deploy apps by using Configuration Manager as described in this section.
|
||||
|
||||
Configuration Manager helps you manage apps by monitoring app installation. You can determine how many of your devices have a specific app installed. Finally, you can allow users to install apps at their discretion or make apps mandatory.
|
||||
|
||||
@ -1529,7 +1606,8 @@ If you selected to manage updates by using Configuration Manager and Intune in a
|
||||
|
||||
To help ensure that your users have the most current features and security protection, keep Windows 10 and your apps current with updates. To configure Windows 10 and app updates, use the **Updates** workspace in Intune.
|
||||
|
||||
>**Note** You can only manage updates (including antivirus and antimalware updates) for Windows 10 desktop operating systems (not Windows 10 Mobile, iOS, or Android).
|
||||
> [!NOTE]
|
||||
> You can only manage updates (including antivirus and antimalware updates) for Windows 10 desktop operating systems (not Windows 10 Mobile, iOS, or Android).
|
||||
|
||||
For more information about how to configure Intune to manage updates and malware protection, see the following resources:
|
||||
|
||||
@ -1542,7 +1620,8 @@ To ensure that your users have the most current features and security protection
|
||||
|
||||
You configure the software updates feature to manage updates for specific versions of Windows and apps. Then, the software updates feature obtains the updates from Windows Updates by using the WSUS server in your environment. This integration provides greater granularity of control over updates and more specific targeting of updates to users and devices (compared to WSUS alone or Intune alone), which allows you to ensure that the right user or device gets the right updates.
|
||||
|
||||
>**Note** When you configure Configuration Manager and Intune in a hybrid model, you use Configuration manager to manage updates as described in this section.
|
||||
> [!NOTE]
|
||||
> When you configure Configuration Manager and Intune in a hybrid model, you use Configuration manager to manage updates as described in this section.
|
||||
|
||||
For more information about how to configure Configuration Manager to manage Windows 10 and app updates, see [Deploy and manage software updates in Configuration Manager](https://technet.microsoft.com/library/mt634340.aspx).
|
||||
|
||||
@ -1571,7 +1650,8 @@ Prior to deployment of Windows 10, complete the tasks in Table 18. Most of these
|
||||
|
||||
Use the Deployment Wizard to deploy Windows 10. With the LTI deployment process, you provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated.
|
||||
|
||||
>**Note** To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/library/dn781089.aspx#Anchor_6).
|
||||
> [!NOTE]
|
||||
> To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/library/dn781089.aspx#Anchor_6).
|
||||
|
||||
|
||||
In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems.
|
||||
@ -1590,7 +1670,8 @@ In most instances, deployments occur without incident. Only in rare occasions do
|
||||
|
||||
After you have deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to [Verify deployment](#verify-deployment).
|
||||
|
||||
>**Note** If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to [Verify deployment](#verify-deployment).
|
||||
> [!NOTE]
|
||||
> If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to [Verify deployment](#verify-deployment).
|
||||
|
||||
#### To set up printers
|
||||
|
||||
|
||||
@ -4,10 +4,11 @@ description: In Windows 10, version 1809, the default removal policy for externa
|
||||
ms.prod: w10
|
||||
author: Teresa-Motiv
|
||||
ms.author: v-tea
|
||||
ms.date: 12/13/2019
|
||||
ms.date: 11/25/2020
|
||||
ms.topic: article
|
||||
ms.custom:
|
||||
- CI 111493
|
||||
- CI 125140
|
||||
- CSSTroubleshooting
|
||||
audience: ITPro
|
||||
ms.localizationpriority: medium
|
||||
@ -44,6 +45,13 @@ To change the policy for an external storage device:
|
||||
|
||||
|
||||
|
||||
6. Select **Policies**, and then select the policy you want to use.
|
||||
6. Select **Policies**.
|
||||
|
||||
> [!NOTE]
|
||||
> Some recent versions of Windows may use a different arrangement of tabs in the disk properties dialog box.
|
||||
>
|
||||
> If you do not see the **Policies** tab, select **Hardware**, select the removable drive from the **All disk drives** list, and then select **Properties**. The **Policies** tab should now be available.
|
||||
|
||||
7. Select the policy that you want to use.
|
||||
|
||||
|
||||
|
||||
@ -172,14 +172,22 @@
|
||||
#### [AboveLock](policy-csp-abovelock.md)
|
||||
#### [Accounts](policy-csp-accounts.md)
|
||||
#### [ActiveXControls](policy-csp-activexcontrols.md)
|
||||
#### [ADMX_ActiveXInstallService](policy-csp-admx-activexinstallservice.md)
|
||||
#### [ADMX_AddRemovePrograms](policy-csp-admx-addremoveprograms.md)
|
||||
#### [ADMX_AppCompat](policy-csp-admx-appcompat.md)
|
||||
#### [ADMX_AppxPackageManager](policy-csp-admx-appxpackagemanager.md)
|
||||
#### [ADMX_AppXRuntime](policy-csp-admx-appxruntime.md)
|
||||
#### [ADMX_AttachmentManager](policy-csp-admx-attachmentmanager.md)
|
||||
#### [ADMX_AuditSettings](policy-csp-admx-auditsettings.md)
|
||||
#### [ADMX_Bits](policy-csp-admx-bits.md)
|
||||
#### [ADMX_CipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md)
|
||||
#### [ADMX_COM](policy-csp-admx-com.md)
|
||||
#### [ADMX_ControlPanel](policy-csp-admx-controlpanel.md)
|
||||
#### [ADMX_ControlPanelDisplay](policy-csp-admx-controlpaneldisplay.md)
|
||||
#### [ADMX_Cpls](policy-csp-admx-cpls.md)
|
||||
#### [ADMX_CredentialProviders](policy-csp-admx-credentialproviders.md)
|
||||
#### [ADMX_CredSsp](policy-csp-admx-credssp.md)
|
||||
#### [ADMX_CredUI](policy-csp-admx-credui.md)
|
||||
#### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md)
|
||||
#### [ADMX_DataCollection](policy-csp-admx-datacollection.md)
|
||||
#### [ADMX_Desktop](policy-csp-admx-desktop.md)
|
||||
@ -235,6 +243,7 @@
|
||||
#### [ADMX_Thumbnails](policy-csp-admx-thumbnails.md)
|
||||
#### [ADMX_TPM](policy-csp-admx-tpm.md)
|
||||
#### [ADMX_UserExperienceVirtualization](policy-csp-admx-userexperiencevirtualization.md)
|
||||
#### [ADMX_UserProfiles](policy-csp-admx-userprofiles.md)
|
||||
#### [ADMX_W32Time](policy-csp-admx-w32time.md)
|
||||
#### [ADMX_WCM](policy-csp-admx-wcm.md)
|
||||
#### [ADMX_WinCal](policy-csp-admx-wincal.md)
|
||||
@ -245,6 +254,7 @@
|
||||
#### [ADMX_WindowsMediaPlayer](policy-csp-admx-windowsmediaplayer.md)
|
||||
#### [ADMX_WindowsStore](policy-csp-admx-windowsstore.md)
|
||||
#### [ADMX_WinInit](policy-csp-admx-wininit.md)
|
||||
#### [ADMX_WinLogon](policy-csp-admx-winlogon.md)
|
||||
#### [ADMX_wlansvc](policy-csp-admx-wlansvc.md)
|
||||
#### [ADMX_WPN](policy-csp-admx-wpn.md)
|
||||
#### [ApplicationDefaults](policy-csp-applicationdefaults.md)
|
||||
|
||||
@ -113,8 +113,7 @@ Requirements:
|
||||
4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use.
|
||||
|
||||
> [!NOTE]
|
||||
> **Device Credential** Credential Type will also work, however, it is not yet supported for MDM solutions (including Intune). We don't recommend using this option until support is announced.
|
||||
|
||||
> **Device Credential** Credential Type may work, however, it is not yet supported by Intune. We don't recommend using this option until it's supported.
|
||||
|
||||
|
||||
5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**.
|
||||
@ -183,6 +182,8 @@ Requirements:
|
||||
- 1909 --> [Administrative Templates (.admx) for Windows 10 November 2019 Update (1909)](https://www.microsoft.com/download/confirmation.aspx?id=100591)
|
||||
|
||||
- 2004 --> [Administrative Templates (.admx) for Windows 10 May 2020 Update (2004)](https://www.microsoft.com/download/confirmation.aspx?id=101445)
|
||||
|
||||
- 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157)
|
||||
|
||||
2. Install the package on the Domain Controller.
|
||||
|
||||
@ -197,6 +198,8 @@ Requirements:
|
||||
- 1909 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 November 2019 Update (1909)**
|
||||
|
||||
- 2004 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2020 Update (2004)**
|
||||
|
||||
- 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)**
|
||||
|
||||
4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get localized product details
|
||||
description: The Get localized product details operation retrieves the localization information of a product from the Micosoft Store for Business.
|
||||
description: The Get localized product details operation retrieves the localization information of a product from the Microsoft Store for Business.
|
||||
ms.assetid: EF6AFCA9-8699-46C9-A3BB-CD2750C07901
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -9,12 +9,12 @@ ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 09/18/2017
|
||||
ms.date: 12/07/2020
|
||||
---
|
||||
|
||||
# Get localized product details
|
||||
|
||||
The **Get localized product details** operation retrieves the localization information of a product from the Micosoft Store for Business.
|
||||
The **Get localized product details** operation retrieves the localization information of a product from the Microsoft Store for Business.
|
||||
|
||||
## Request
|
||||
|
||||
|
||||
@ -21,7 +21,8 @@ ms.date: 10/08/2020
|
||||
>
|
||||
|
||||
- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites)
|
||||
- [ADMX_AddRemovePrograms/DefaultCategory](/policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory)
|
||||
- [ADMX_ActiveXInstallService/AxISURLZonePolicies](./policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies)
|
||||
- [ADMX_AddRemovePrograms/DefaultCategory](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory)
|
||||
- [ADMX_AddRemovePrograms/NoAddFromCDorFloppy](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy)
|
||||
- [ADMX_AddRemovePrograms/NoAddFromInternet](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet)
|
||||
- [ADMX_AddRemovePrograms/NoAddFromNetwork](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork)
|
||||
@ -41,6 +42,16 @@ ms.date: 10/08/2020
|
||||
- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_2)
|
||||
- [ADMX_AppCompat/AppCompatTurnOffUserActionRecord](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord)
|
||||
- [ADMX_AppCompat/AppCompatTurnOffProgramInventory](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory)
|
||||
- [ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles](./policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles)
|
||||
- [ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules)
|
||||
- [ADMX_AppXRuntime/AppxRuntimeBlockFileElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation)
|
||||
- [ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt)
|
||||
- [ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation)
|
||||
- [ADMX_AttachmentManager/AM_EstimateFileHandlerRisk](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk)
|
||||
- [ADMX_AttachmentManager/AM_SetFileRiskLevel](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel)
|
||||
- [ADMX_AttachmentManager/AM_SetHighRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion)
|
||||
- [ADMX_AttachmentManager/AM_SetLowRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion)
|
||||
- [ADMX_AttachmentManager/AM_SetModRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion)
|
||||
- [ADMX_AuditSettings/IncludeCmdLine](./policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline)
|
||||
- [ADMX_Bits/BITS_DisableBranchCache](./policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache)
|
||||
- [ADMX_Bits/BITS_DisablePeercachingClient](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient)
|
||||
@ -60,7 +71,38 @@ ms.date: 10/08/2020
|
||||
- [ADMX_CipherSuiteOrder/SSLCurveOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder)
|
||||
- [ADMX_COM/AppMgmt_COM_SearchForCLSID_1](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1)
|
||||
- [ADMX_COM/AppMgmt_COM_SearchForCLSID_2](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2)
|
||||
- [ADMX_ControlPanel/DisallowCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls)
|
||||
- [ADMX_ControlPanel/ForceClassicControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel)
|
||||
- [ADMX_ControlPanel/NoControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel)
|
||||
- [ADMX_ControlPanel/RestrictCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Display_Disable](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Display_HideSettings](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle)
|
||||
- [ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground)
|
||||
- [ADMX_Cpls/UseDefaultTile](./policy-csp-admx-cpls.md#admx-cpls-usedefaulttile)
|
||||
- [ADMX_CredentialProviders/AllowDomainDelayLock](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock)
|
||||
- [ADMX_CredentialProviders/DefaultCredentialProvider](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider)
|
||||
- [ADMX_CredentialProviders/ExcludedCredentialProviders](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders)
|
||||
- [ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly)
|
||||
- [ADMX_CredSsp/AllowDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials)
|
||||
- [ADMX_CredSsp/AllowEncryptionOracle](./policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle)
|
||||
@ -72,6 +114,8 @@ ms.date: 10/08/2020
|
||||
- [ADMX_CredSsp/DenyFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials)
|
||||
- [ADMX_CredSsp/DenySavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials)
|
||||
- [ADMX_CredSsp/RestrictedRemoteAdministration](./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration)
|
||||
- [ADMX_CredUI/EnableSecureCredentialPrompting](./policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting)
|
||||
- [ADMX_CredUI/NoLocalPasswordResetQuestions](./policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions)
|
||||
- [ADMX_CtrlAltDel/DisableChangePassword](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword)
|
||||
- [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer)
|
||||
- [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr)
|
||||
@ -914,6 +958,14 @@ ms.date: 10/08/2020
|
||||
- [ADMX_UserExperienceVirtualization/Video](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video)
|
||||
- [ADMX_UserExperienceVirtualization/Weather](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather)
|
||||
- [ADMX_UserExperienceVirtualization/Wordpad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad)
|
||||
- [ADMX_UserProfiles/CleanupProfiles](./policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles)
|
||||
- [ADMX_UserProfiles/DontForceUnloadHive](./policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive)
|
||||
- [ADMX_UserProfiles/LeaveAppMgmtData](./policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata)
|
||||
- [ADMX_UserProfiles/LimitSize](./policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize)
|
||||
- [ADMX_UserProfiles/ProfileErrorAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction)
|
||||
- [ADMX_UserProfiles/SlowLinkTimeOut](./policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout)
|
||||
- [ADMX_UserProfiles/USER_HOME](./policy-csp-admx-userprofiles.md#admx-userprofiles-user-home)
|
||||
- [ADMX_UserProfiles/UserInfoAccessAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction)
|
||||
- [ADMX_W32Time/W32TIME_POLICY_CONFIG](./policy-csp-admx-w32time.md#admx-w32time-policy-config)
|
||||
- [ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-configure-ntpclient)
|
||||
- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpclient)
|
||||
@ -1028,6 +1080,12 @@ ms.date: 10/08/2020
|
||||
- [ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription](./policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription)
|
||||
- [ADMX_WinInit/Hiberboot](./policy-csp-admx-wininit.md#admx-wininit-hiberboot)
|
||||
- [ADMX_WinInit/ShutdownTimeoutHungSessionsDescription](./policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription)
|
||||
- [ADMX_WinLogon/CustomShell](./policy-csp-admx-winlogon.md#admx-winlogon-customshell)
|
||||
- [ADMX_WinLogon/DisplayLastLogonInfoDescription](./policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription)
|
||||
- [ADMX_WinLogon/LogonHoursNotificationPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription)
|
||||
- [ADMX_WinLogon/LogonHoursPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription)
|
||||
- [ADMX_WinLogon/ReportCachedLogonPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription)
|
||||
- [ADMX_WinLogon/SoftwareSASGeneration](./policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration)
|
||||
- [ADMX_wlansvc/SetCost](./policy-csp-admx-wlansvc.md#admx-wlansvc-setcost)
|
||||
- [ADMX_wlansvc/SetPINEnforced](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced)
|
||||
- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred)
|
||||
|
||||
@ -168,6 +168,14 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_ActiveXInstallService policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies" id="admx-activexinstallservice-axisurlzonepolicies">ADMX_ActiveXInstallService/AxISURLZonePolicies</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_AddRemovePrograms policies
|
||||
<dl>
|
||||
<dd>
|
||||
@ -237,6 +245,51 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_AppxPackageManager policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles" id="admx-appxpackagemanager-allowdeploymentinspecialprofiles">ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_AppXRuntime policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules" id="admx-appxruntime-appxruntimeapplicationcontenturirules">ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation" id="admx-appxruntime-appxruntimeblockfileelevation">ADMX_AppXRuntime/AppxRuntimeBlockFileElevation</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt" id="admx-appxruntime-appxruntimeblockhostedappaccesswinrt">ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation" id="admx-appxruntime-appxruntimeblockprotocolelevation">ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_AttachmentManager policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk" id="admx-attachmentmanager-am-estimatefilehandlerrisk">ADMX_AttachmentManager/AM_EstimateFileHandlerRisk</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel" id="admx-attachmentmanager-am-setfilerisklevel">ADMX_AttachmentManager/AM_SetFileRiskLevel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion" id="admx-attachmentmanager-am-sethighriskinclusion">ADMX_AttachmentManager/AM_SetHighRiskInclusion</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion" id="admx-attachmentmanager-am-setlowriskinclusion">ADMX_AttachmentManager/AM_SetLowRiskInclusion</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion" id="admx-attachmentmanager-am-setmodriskinclusion">ADMX_AttachmentManager/AM_SetModRiskInclusion</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_AuditSettings policies
|
||||
|
||||
<dl>
|
||||
@ -245,6 +298,7 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
### ADMX_Bits policies
|
||||
|
||||
<dl>
|
||||
@ -314,6 +368,99 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_ControlPanel policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls" id="admx-controlpanel-disallowcpls">ADMX_ControlPanel/DisallowCpls</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel" id="admx-controlpanel-forceclassiccontrolpanel">ADMX_ControlPanel/ForceClassicControlPanel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel" id="admx-controlpanel-nocontrolpanel">ADMX_ControlPanel/NoControlPanel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls" id="admx-controlpanel-restrictcpls">ADMX_ControlPanel/RestrictCpls</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_ControlPanelDisplay policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable" id="">ADMX_ControlPanelDisplay/CPL_Display_Disable</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings" id="">ADMX_ControlPanelDisplay/CPL_Display_HideSettings</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice" id="">ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange" id="">ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle" id="">ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver" id="admx-controlpaneldisplay-cpl-personalization-enablescreensaver">ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen" id="admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen">ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize" id="admx-controlpaneldisplay-cpl-personalization-lockfontsize">ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen" id="admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen">ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground" id="admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground">ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui" id="admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui">ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui" id="admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui">ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui" id="admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui">ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen" id="admx-controlpaneldisplay-cpl-personalization-nolockscreen">ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui" id="admx-controlpaneldisplay-cpl-personalization-nomousepointersui">ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui" id="admx-controlpaneldisplay-cpl-personalization-noscreensaverui">ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui" id="admx-controlpaneldisplay-cpl-personalization-nosoundschemeui">ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors" id="admx-controlpaneldisplay-cpl-personalization-personalcolors">ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure" id="admx-controlpaneldisplay-cpl-personalization-screensaverissecure">ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout" id="admx-controlpaneldisplay-cpl-personalization-screensavertimeout">ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver" id="admx-controlpaneldisplay-cpl-personalization-setscreensaver">ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme" id="admx-controlpaneldisplay-cpl-personalization-settheme">ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle" id="admx-controlpaneldisplay-cpl-personalization-setvisualstyle">ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground" id="admx-controlpaneldisplay-cpl-personalization-startbackground">ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_Cpls policies
|
||||
|
||||
@ -332,6 +479,20 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_CredentialProviders policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock" id="admx-credentialproviders-allowdomaindelaylock">ADMX_CredentialProviders/AllowDomainDelayLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider" id="admx-credentialproviders-defaultcredentialprovider">ADMX_CredentialProviders/DefaultCredentialProvider</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders" id="admx-credentialproviders-excludedcredentialproviders">ADMX_CredentialProviders/ExcludedCredentialProviders</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_CredSsp policies
|
||||
|
||||
<dl>
|
||||
@ -367,6 +528,15 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration" id="admx-credssp-restrictedremoteadministration">ADMX_CredSsp/RestrictedRemoteAdministration</a>
|
||||
|
||||
### ADMX_CredUI policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting" id="admx-credui-enablesecurecredentialprompting">ADMX_CredUI/EnableSecureCredentialPrompting</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions" id="admx-credui-nolocalpasswordresetquestions">ADMX_CredUI/NoLocalPasswordResetQuestions</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
@ -3146,6 +3316,35 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_UserProfiles policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles" id="admx-userprofiles-cleanupprofiles">ADMX_UserProfiles/CleanupProfiles</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive" id="admx-userprofiles-dontforceunloadhive">ADMX_UserProfiles/DontForceUnloadHive</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata" id="admx-userprofiles-leaveappmgmtdata">ADMX_UserProfiles/LeaveAppMgmtData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize" id="admx-userprofiles-limitsize">ADMX_UserProfiles/LimitSize</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction" id="admx-userprofiles-profileerroraction">ADMX_UserProfiles/ProfileErrorAction</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout" id="admx-userprofiles-slowlinktimeout">ADMX_UserProfiles/SlowLinkTimeOut</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-user-home" id="admx-userprofiles-user-home">ADMX_UserProfiles/USER_HOME</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction" id="admx-userprofiles-userinfoaccessaction">ADMX_UserProfiles/UserInfoAccessAction</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_W32Time policies
|
||||
|
||||
<dl>
|
||||
@ -3539,6 +3738,29 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_WinLogon policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-customshell" id="admx-winlogon-customshell">ADMX_WinLogon/CustomShell</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription" id="admx-winlogon-displaylastlogoninfodescription">ADMX_WinLogon/DisplayLastLogonInfoDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription" id="admx-winlogon-logonhoursnotificationpolicydescription">ADMX_WinLogon/LogonHoursNotificationPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription" id="admx-winlogon-logonhourspolicydescription">ADMX_WinLogon/LogonHoursPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription" id="admx-winlogon-reportcachedlogonpolicydescription">ADMX_WinLogon/ReportCachedLogonPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration" id="admx-winlogon-softwaresasgeneration">ADMX_WinLogon/SoftwareSASGeneration</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
### ADMX_wlansvc policies
|
||||
|
||||
<dl>
|
||||
|
||||
@ -0,0 +1,119 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_ActiveXInstallService
|
||||
description: Policy CSP - ADMX_ActiveXInstallService
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/09/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_ActiveXInstallService
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_ActiveXInstallService policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-activexinstallservice-axisurlzonepolicies">ADMX_ActiveXInstallService/AxISURLZonePolicies</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-activexinstallservice-axisurlzonepolicies"></a>**ADMX_ActiveXInstallService/AxISURLZonePolicies**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls the installation of ActiveX controls for sites in Trusted zone.
|
||||
|
||||
If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting.
|
||||
|
||||
If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation.
|
||||
|
||||
If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore.
|
||||
|
||||
> [!NOTE]
|
||||
> This policy setting applies to all sites in Trusted zones.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Establish ActiveX installation policy for sites in Trusted zones*
|
||||
- GP name: *AxISURLZonePolicies*
|
||||
- GP path: *Windows Components\ActiveX Installer Service*
|
||||
- GP ADMX file name: *ActiveXInstallService.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -0,0 +1,120 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_AppxPackageManager
|
||||
description: Policy CSP - ADMX_AppxPackageManager
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/10/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_AppxPackageManager
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_AppxPackageManager policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-appxpackagemanager-allowdeploymentinspecialprofiles">ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-appxpackagemanager-allowdeploymentinspecialprofiles"></a>**ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile.
|
||||
|
||||
Special profiles are the following user profiles, where changes are discarded after the user signs off:
|
||||
|
||||
- Roaming user profiles to which the "Delete cached copies of roaming profiles" Group Policy setting applies
|
||||
- Mandatory user profiles and super-mandatory profiles, which are created by an administrator
|
||||
- Temporary user profiles, which are created when an error prevents the correct profile from loading
|
||||
- User profiles for the Guest account and members of the Guests group
|
||||
|
||||
If you enable this policy setting, Group Policy allows deployment operations (adding, registering, staging, updating, or removing an app package) of Windows Store apps when using a special profile.
|
||||
|
||||
If you disable or do not configure this policy setting, Group Policy blocks deployment operations of Windows Store apps when using a special profile.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Allow deployment operations in special profiles*
|
||||
- GP name: *AllowDeploymentInSpecialProfiles*
|
||||
- GP path: *Windows Components\App Package Deployment*
|
||||
- GP ADMX file name: *AppxPackageManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
338
windows/client-management/mdm/policy-csp-admx-appxruntime.md
Normal file
338
windows/client-management/mdm/policy-csp-admx-appxruntime.md
Normal file
@ -0,0 +1,338 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_AppXRuntime
|
||||
description: Policy CSP - ADMX_AppXRuntime
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/10/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_AppXRuntime
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_AppXRuntime policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-appxruntime-appxruntimeapplicationcontenturirules">ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-appxruntime-appxruntimeblockfileelevation">ADMX_AppXRuntime/AppxRuntimeBlockFileElevation</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-appxruntime-appxruntimeblockhostedappaccesswinrt">ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-appxruntime-appxruntimeblockprotocolelevation">ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-appxruntime-appxruntimeapplicationcontenturirules"></a>**ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer.
|
||||
|
||||
If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use.
|
||||
|
||||
If you disable or don't set this policy setting, Windows Store apps will only use the static Content URI Rules.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Turn on dynamic Content URI Rules for Windows store apps*
|
||||
- GP name: *AppxRuntimeApplicationContentUriRules*
|
||||
- GP path: *Windows Components\App runtime*
|
||||
- GP ADMX file name: *AppXRuntime.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-appxruntime-appxruntimeblockfileelevation"></a>**ADMX_AppXRuntime/AppxRuntimeBlockFileElevation**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type.
|
||||
|
||||
If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows Store apps can open files in the default desktop app for a file type.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Block launching desktop apps associated with a file.*
|
||||
- GP name: *AppxRuntimeBlockFileElevation*
|
||||
- GP path: *Windows Components\App runtime*
|
||||
- GP ADMX file name: *AppXRuntime.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-appxruntime-appxruntimeblockhostedappaccesswinrt"></a>**ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched.
|
||||
|
||||
If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected.
|
||||
|
||||
If you disable or do not configure this policy setting, all Universal Windows apps can be launched.
|
||||
|
||||
> [!WARNING]
|
||||
> This policy should not be enabled unless recommended by Microsoft as a security response because it can cause severe app compatibility issues.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Block launching Universal Windows apps with Windows Runtime API access from hosted content.*
|
||||
- GP name: *AppxRuntimeBlockHostedAppAccessWinRT*
|
||||
- GP path: *Windows Components\App runtime*
|
||||
- GP ADMX file name: *AppXRuntime.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-appxruntime-appxruntimeblockprotocolelevation"></a>**ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app.
|
||||
|
||||
If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows Store apps can open URIs in the default desktop app for a URI scheme.
|
||||
|
||||
> [!NOTE]
|
||||
> Enabling this policy setting does not block Windows Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Block launching desktop apps associated with a URI scheme*
|
||||
- GP name: *AppxRuntimeBlockProtocolElevation*
|
||||
- GP path: *Windows Components\App runtime*
|
||||
- GP ADMX file name: *AppXRuntime.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
@ -0,0 +1,422 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_AttachmentManager
|
||||
description: Policy CSP - ADMX_AttachmentManager
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/10/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_AttachmentManager
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_AttachmentManager policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-attachmentmanager-am-estimatefilehandlerrisk">ADMX_AttachmentManager/AM_EstimateFileHandlerRisk</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-attachmentmanager-am-setfilerisklevel">ADMX_AttachmentManager/AM_SetFileRiskLevel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-attachmentmanager-am-sethighriskinclusion">ADMX_AttachmentManager/AM_SetHighRiskInclusion</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-attachmentmanager-am-setlowriskinclusion">ADMX_AttachmentManager/AM_SetLowRiskInclusion</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-attachmentmanager-am-setmodriskinclusion">ADMX_AttachmentManager/AM_SetModRiskInclusion</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-attachmentmanager-am-estimatefilehandlerrisk"></a>**ADMX_AttachmentManager/AM_EstimateFileHandlerRisk**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments.
|
||||
|
||||
Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files.
|
||||
|
||||
Preferring the file type instructs Windows to use the file type data over the file handler data. For example, trust .txt files, regardless of the file handler. Using both the file handler and type data is the most restrictive option. Windows chooses the more restrictive recommendation which will cause users to see more trust prompts than choosing the other options.
|
||||
|
||||
If you enable this policy setting, you can choose the order in which Windows processes risk assessment data.
|
||||
|
||||
If you disable this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.
|
||||
|
||||
If you do not configure this policy setting, Windows uses its default trust logic, which prefers the file handler over the file type.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Trust logic for file attachments*
|
||||
- GP name: *AM_EstimateFileHandlerRisk*
|
||||
- GP path: *Windows Components\Attachment Manager*
|
||||
- GP ADMX file name: *AttachmentManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-attachmentmanager-am-setfilerisklevel"></a>**ADMX_AttachmentManager/AM_SetFileRiskLevel**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments.
|
||||
|
||||
High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file.
|
||||
|
||||
Moderate Risk: If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file.
|
||||
|
||||
Low Risk: If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information.
|
||||
|
||||
If you enable this policy setting, you can specify the default risk level for file types.
|
||||
|
||||
If you disable this policy setting, Windows sets the default risk level to moderate.
|
||||
|
||||
If you do not configure this policy setting, Windows sets the default risk level to moderate.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Default risk level for file attachments*
|
||||
- GP name: *AM_SetFileRiskLevel*
|
||||
- GP path: *Windows Components\Attachment Manager*
|
||||
- GP ADMX file name: *AttachmentManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-attachmentmanager-am-sethighriskinclusion"></a>**ADMX_AttachmentManager/AM_SetHighRiskInclusion**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list).
|
||||
|
||||
If you enable this policy setting, you can create a custom list of high-risk file types.
|
||||
|
||||
If you disable this policy setting, Windows uses its built-in list of file types that pose a high risk.
|
||||
|
||||
If you do not configure this policy setting, Windows uses its built-in list of high-risk file types.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Inclusion list for high risk file types*
|
||||
- GP name: *AM_SetHighRiskInclusion*
|
||||
- GP path: *Windows Components\Attachment Manager*
|
||||
- GP ADMX file name: *AttachmentManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-attachmentmanager-am-setlowriskinclusion"></a>**ADMX_AttachmentManager/AM_SetLowRiskInclusion**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list).
|
||||
|
||||
If you enable this policy setting, you can specify file types that pose a low risk.
|
||||
|
||||
If you disable this policy setting, Windows uses its default trust logic.
|
||||
|
||||
If you do not configure this policy setting, Windows uses its default trust logic.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Inclusion list for low file types*
|
||||
- GP name: *AM_SetLowRiskInclusion*
|
||||
- GP path: *Windows Components\Attachment Manager*
|
||||
- GP ADMX file name: *AttachmentManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-attachmentmanager-am-setmodriskinclusion"></a>**ADMX_AttachmentManager/AM_SetModRiskInclusion**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list).
|
||||
|
||||
If you enable this policy setting, you can specify file types which pose a moderate risk.
|
||||
|
||||
If you disable this policy setting, Windows uses its default trust logic.
|
||||
|
||||
If you do not configure this policy setting, Windows uses its default trust logic.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Inclusion list for moderate risk file types*
|
||||
- GP name: *AM_SetModRiskInclusion*
|
||||
- GP path: *Windows Components\Attachment Manager*
|
||||
- GP ADMX file name: *AttachmentManager.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
362
windows/client-management/mdm/policy-csp-admx-controlpanel.md
Normal file
362
windows/client-management/mdm/policy-csp-admx-controlpanel.md
Normal file
@ -0,0 +1,362 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_ControlPanel
|
||||
description: Policy CSP - ADMX_ControlPanel
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/05/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_ControlPanel
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_ControlPanel policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-controlpanel-disallowcpls">ADMX_ControlPanel/DisallowCpls</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-controlpanel-forceclassiccontrolpanel">ADMX_ControlPanel/ForceClassicControlPanel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-controlpanel-nocontrolpanel">ADMX_ControlPanel/NoControlPanel</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-controlpanel-restrictcpls">ADMX_ControlPanel/RestrictCpls</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-controlpanel-disallowcpls"></a>**ADMX_ControlPanel/DisallowCpls**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings.
|
||||
|
||||
If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen.
|
||||
|
||||
To hide a Control Panel item, enable this policy setting and click Show to access the list of disallowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization.
|
||||
|
||||
> [!NOTE]
|
||||
> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name should be entered, for example timedate.cpl or inetcpl.cpl. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered, for example @systemcpl.dll,-1 for System, or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names can be found in MSDN by searching "Control Panel items".
|
||||
|
||||
If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.
|
||||
|
||||
> [!NOTE]
|
||||
> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead. Note: To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Hide specified Control Panel items*
|
||||
- GP name: *DisallowCpls*
|
||||
- GP path: *Control Panel*
|
||||
- GP ADMX file name: *ControlPanel.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-controlpanel-forceclassiccontrolpanel"></a>**ADMX_ControlPanel/ForceClassicControlPanel**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default Control Panel view, whether by category or icons.
|
||||
|
||||
If this policy setting is enabled, the Control Panel opens to the icon view.
|
||||
|
||||
If this policy setting is disabled, the Control Panel opens to the category view.
|
||||
|
||||
If this policy setting is not configured, the Control Panel opens to the view used in the last Control Panel session.
|
||||
|
||||
> [!NOTE]
|
||||
> Icon size is dependent upon what the user has set it to in the previous session.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Always open All Control Panel Items when opening Control Panel*
|
||||
- GP name: *ForceClassicControlPanel*
|
||||
- GP path: *Control Panel*
|
||||
- GP ADMX file name: *ControlPanel.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-controlpanel-nocontrolpanel"></a>**ADMX_ControlPanel/NoControlPanel**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. Disables all Control Panel programs and the PC settings app.
|
||||
|
||||
This setting prevents Control.exe and SystemSettings.exe, the program files for Control Panel and PC settings, from starting. As a result, users cannot start Control Panel or PC settings, or run any of their items.
|
||||
|
||||
This setting removes Control Panel from:
|
||||
|
||||
- The Start screen
|
||||
- File Explorer
|
||||
|
||||
This setting removes PC settings from:
|
||||
|
||||
- The Start screen
|
||||
- Settings charm
|
||||
- Account picture
|
||||
- Search results
|
||||
|
||||
If users try to select a Control Panel item from the Properties item on a context menu, a message appears explaining that a setting prevents the action.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Prohibit access to Control Panel and PC settings*
|
||||
- GP name: *NoControlPanel*
|
||||
- GP path: *Control Panel*
|
||||
- GP ADMX file name: *ControlPanel.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-controlpanel-restrictcpls"></a>**ADMX_ControlPanel/RestrictCpls**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings.
|
||||
|
||||
To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization.
|
||||
|
||||
> [!NOTE]
|
||||
> For Windows Vista, Windows Server 2008, and earlier versions of Windows, the module name, for example timedate.cpl or inetcpl.cpl, should be entered. If a Control Panel item does not have a CPL file, or the CPL file contains multiple applets, then its module name and string resource identification number should be entered. For example, enter @systemcpl.dll,-1 for System or @themecpl.dll,-1 for Personalization. A complete list of canonical and module names of Control Panel items can be found in MSDN by searching "Control Panel items".
|
||||
|
||||
If both the "Hide specified Control Panel items" setting and the "Show only specified Control Panel items" setting are enabled, the "Show only specified Control Panel items" setting is ignored.
|
||||
|
||||
> [!NOTE]
|
||||
> The Display Control Panel item cannot be hidden in the Desktop context menu by using this setting. To hide the Display Control Panel item and prevent users from modifying the computer's display settings use the "Disable Display Control Panel" setting instead.
|
||||
>
|
||||
> To hide pages in the System Settings app, use the "Settings Page Visibility" setting under Computer Configuration.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Show only specified Control Panel items*
|
||||
- GP name: *RestrictCpls*
|
||||
- GP path: *Control Panel*
|
||||
- GP ADMX file name: *ControlPanel.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
1825
windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
Normal file
1825
windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md
Normal file
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,269 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_CredentialProviders
|
||||
description: Policy CSP - ADMX_CredentialProviders
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/11/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_CredentialProviders
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_CredentialProviders policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-credentialproviders-allowdomaindelaylock">ADMX_CredentialProviders/AllowDomainDelayLock</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-credentialproviders-defaultcredentialprovider">ADMX_CredentialProviders/DefaultCredentialProvider</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-credentialproviders-excludedcredentialproviders">ADMX_CredentialProviders/ExcludedCredentialProviders</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-credentialproviders-allowdomaindelaylock"></a>**ADMX_CredentialProviders/AllowDomainDelayLock**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off.
|
||||
|
||||
If you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.
|
||||
|
||||
If you disable this policy setting, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.
|
||||
|
||||
If you don't configure this policy setting on a domain-joined device, a user cannot change the amount of time after the device's screen turns off before a password is required when waking the device. Instead, a password is required immediately after the screen turns off.
|
||||
|
||||
If you don't configure this policy setting on a workgroup device, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Allow users to select when a password is required when resuming from connected standby*
|
||||
- GP name: *AllowDomainDelayLock*
|
||||
- GP path: *System\Logon*
|
||||
- GP ADMX file name: *CredentialProviders.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-credentialproviders-defaultcredentialprovider"></a>**ADMX_CredentialProviders/DefaultCredentialProvider**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to assign a specified credential provider as the default credential provider.
|
||||
|
||||
If you enable this policy setting, the specified credential provider is selected on other user tile.
|
||||
|
||||
If you disable or do not configure this policy setting, the system picks the default credential provider on other user tile.
|
||||
|
||||
> [!NOTE]
|
||||
> A list of registered credential providers and their GUIDs can be found in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Assign a default credential provider*
|
||||
- GP name: *DefaultCredentialProvider*
|
||||
- GP path: *System\Logon*
|
||||
- GP ADMX file name: *CredentialProviders.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-credentialproviders-excludedcredentialproviders"></a>**ADMX_CredentialProviders/ExcludedCredentialProviders**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to exclude the specified credential providers from use during authentication.
|
||||
|
||||
> [!NOTE]
|
||||
> Credential providers are used to process and validate user credentials during logon or when authentication is required. Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication).
|
||||
|
||||
If you enable this policy, an administrator can specify the CLSIDs of the credential providers to exclude from the set of installed credential providers available for authentication purposes.
|
||||
|
||||
If you disable or do not configure this policy, all installed and otherwise enabled credential providers are available for authentication purposes.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Exclude credential providers*
|
||||
- GP name: *ExcludedCredentialProviders*
|
||||
- GP path: *System\Logon*
|
||||
- GP ADMX file name: *CredentialProviders.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
185
windows/client-management/mdm/policy-csp-admx-credui.md
Normal file
185
windows/client-management/mdm/policy-csp-admx-credui.md
Normal file
@ -0,0 +1,185 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_CredUI
|
||||
description: Policy CSP - ADMX_CredUI
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/09/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_CredUI
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_CredUI policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-credui-enablesecurecredentialprompting">ADMX_CredUI/EnableSecureCredentialPrompting</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-credui-nolocalpasswordresetquestions">ADMX_CredUI/NoLocalPasswordResetQuestions</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-credui-enablesecurecredentialprompting"></a>**ADMX_CredUI/EnableSecureCredentialPrompting**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials.
|
||||
|
||||
> [!NOTE]
|
||||
> This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled.
|
||||
|
||||
If you enable this policy setting, users will be required to enter Windows credentials on the Secure Desktop by means of the trusted path mechanism.
|
||||
|
||||
If you disable or do not configure this policy setting, users will enter Windows credentials within the user’s desktop session, potentially allowing malicious code access to the user’s Windows credentials.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Require trusted path for credential entry*
|
||||
- GP name: *EnableSecureCredentialPrompting*
|
||||
- GP path: *Windows Components\Credential User Interface*
|
||||
- GP ADMX file name: *CredUI.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-credui-nolocalpasswordresetquestions"></a>**ADMX_CredUI/NoLocalPasswordResetQuestions**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. If you turn this policy setting on, local users won’t be able to set up and use security questions to reset their passwords.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Prevent the use of security questions for local accounts*
|
||||
- GP name: *NoLocalPasswordResetQuestions*
|
||||
- GP path: *Windows Components\Credential User Interface*
|
||||
- GP ADMX file name: *CredUI.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
655
windows/client-management/mdm/policy-csp-admx-userprofiles.md
Normal file
655
windows/client-management/mdm/policy-csp-admx-userprofiles.md
Normal file
@ -0,0 +1,655 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_UserProfiles
|
||||
description: Policy CSP - ADMX_UserProfiles
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/11/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_UserProfiles
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_UserProfiles policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-cleanupprofiles">ADMX_UserProfiles/CleanupProfiles</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-dontforceunloadhive">ADMX_UserProfiles/DontForceUnloadHive</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-leaveappmgmtdata">ADMX_UserProfiles/LeaveAppMgmtData</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-limitsize">ADMX_UserProfiles/LimitSize</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-profileerroraction">ADMX_UserProfiles/ProfileErrorAction</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-slowlinktimeout">ADMX_UserProfiles/SlowLinkTimeOut</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-user-home">ADMX_UserProfiles/USER_HOME</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-userprofiles-userinfoaccessaction">ADMX_UserProfiles/UserInfoAccessAction</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-cleanupprofiles"></a>**ADMX_UserProfiles/CleanupProfiles**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to automatically delete user profiles on system restart that have not been used within a specified number of days. Note: One day is interpreted as 24 hours after a specific user profile was accessed.
|
||||
|
||||
If you enable this policy setting, the User Profile Service will automatically delete on the next system restart all user profiles on the computer that have not been used within the specified number of days.
|
||||
|
||||
If you disable or do not configure this policy setting, User Profile Service will not automatically delete any profiles on the next system restart.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Delete user profiles older than a specified number of days on system restart*
|
||||
- GP name: *CleanupProfiles*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-dontforceunloadhive"></a>**ADMX_UserProfiles/DontForceUnloadHive**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows forcefully unloads the user's registry at logoff, even if there are open handles to the per-user registry keys.
|
||||
|
||||
Note: This policy setting should only be used for cases where you may be running into application compatibility issues due to this specific Windows behavior. It is not recommended to enable this policy by default as it may prevent users from getting an updated version of their roaming user profile.
|
||||
|
||||
If you enable this policy setting, Windows will not forcefully unload the users registry at logoff, but will unload the registry when all open handles to the per-user registry keys are closed.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will always unload the users registry at logoff, even if there are any open handles to the per-user registry keys at user logoff.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Do not forcefully unload the users registry at user logoff*
|
||||
- GP name: *DontForceUnloadHive*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-leaveappmgmtdata"></a>**ADMX_UserProfiles/LeaveAppMgmtData**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the system retains a roaming user's Windows Installer and Group Policy based software installation data on their profile deletion.
|
||||
|
||||
By default Windows deletes all information related to a roaming user (which includes the user's settings, data, Windows Installer related data, and the like) when their profile is deleted. As a result, the next time a roaming user whose profile was previously deleted on that client logs on, they will need to reinstall all apps published via policy at logon increasing logon time. You can use this policy setting to change this behavior.
|
||||
|
||||
If you enable this policy setting, Windows will not delete Windows Installer or Group Policy software installation data for roaming users when profiles are deleted from the machine. This will improve the performance of Group Policy based Software Installation during user logon when a user profile is deleted and that user subsequently logs on to the machine.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows will delete the entire profile for roaming users, including the Windows Installer and Group Policy software installation data when those profiles are deleted.
|
||||
|
||||
> [!NOTE]
|
||||
> If this policy setting is enabled for a machine, local administrator action is required to remove the Windows Installer or Group Policy software installation data stored in the registry and file system of roaming users' profiles on the machine.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Leave Windows Installer and Group Policy Software Installation Data*
|
||||
- GP name: *LeaveAppMgmtData*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-limitsize"></a>**ADMX_UserProfiles/LimitSize**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting sets the maximum size of each user profile and determines the system's response when a user profile reaches the maximum size. This policy setting affects both local and roaming profiles.
|
||||
|
||||
If you disable this policy setting or do not configure it, the system does not limit the size of user profiles.
|
||||
|
||||
If you enable this policy setting, you can:
|
||||
|
||||
- Set a maximum permitted user profile size.
|
||||
- Determine whether the registry files are included in the calculation of the profile size.
|
||||
- Determine whether users are notified when the profile exceeds the permitted maximum size.
|
||||
- Specify a customized message notifying users of the oversized profile.
|
||||
- Determine how often the customized message is displayed.
|
||||
|
||||
> [!NOTE]
|
||||
> In operating systems earlier than Microsoft Windows Vista, Windows will not allow users to log off until the profile size has been reduced to within the allowable limit. In Microsoft Windows Vista, Windows will not block users from logging off. Instead, if the user has a roaming user profile, Windows will not synchronize the user's profile with the roaming profile server if the maximum profile size limit specified here is exceeded.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Limit profile size*
|
||||
- GP name: *LimitSize*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-profileerroraction"></a>**ADMX_UserProfiles/ProfileErrorAction**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting will automatically log off a user when Windows cannot load their profile.
|
||||
|
||||
If Windows cannot access the user profile folder or the profile contains errors that prevent it from loading, Windows logs on the user with a temporary profile. This policy setting allows the administrator to disable this behavior, preventing Windows from logging on the user with a temporary profile.
|
||||
|
||||
If you enable this policy setting, Windows will not log on a user with a temporary profile. Windows logs the user off if their profile cannot be loaded.
|
||||
|
||||
If you disable this policy setting or do not configure it, Windows logs on the user with a temporary profile when Windows cannot load their user profile.
|
||||
|
||||
Also, see the "Delete cached copies of roaming profiles" policy setting.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Do not log users on with temporary profiles*
|
||||
- GP name: *ProfileErrorAction*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-slowlinktimeout"></a>**ADMX_UserProfiles/SlowLinkTimeOut**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting defines a slow connection for roaming user profiles and establishes thresholds for two tests of network speed.
|
||||
|
||||
To determine the network performance characteristics, a connection is made to the file share storing the user's profile and 64 kilobytes of data is transferred. From that connection and data transfer, the network's latency and connection speed are determined.
|
||||
|
||||
This policy setting and related policy settings in this folder together define the system's response when roaming user profiles are slow to load.
|
||||
|
||||
If you enable this policy setting, you can change how long Windows waits for a response from the server before considering the connection to be slow.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows considers the network connection to be slow if the server returns less than 500 kilobits of data per second or take 120 milliseconds to respond.Consider increasing this value for clients using DHCP Service-assigned addresses or for computers accessing profiles across dial-up connections.Important: If the "Do not detect slow network connections" policy setting is enabled, this policy setting is ignored. Also, if the "Delete cached copies of roaming profiles" policy setting is enabled, there is no local copy of the roaming profile to load when the system detects a slow connection.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Control slow network connection timeout for user profiles*
|
||||
- GP name: *SlowLinkTimeOut*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-user-home"></a>**ADMX_UserProfiles/USER_HOME**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the location and root (file share or local path) of a user's home folder for a logon session.
|
||||
|
||||
If you enable this policy setting, the user's home folder is configured to the specified local or network location, creating a new folder for each user name.
|
||||
|
||||
To use this policy setting, in the Location list, choose the location for the home folder. If you choose “On the network,” enter the path to a file share in the Path box (for example, \\\\ComputerName\ShareName), and then choose the drive letter to assign to the file share. If you choose “On the local computer,” enter a local path (for example, C:\HomeFolder) in the Path box.
|
||||
|
||||
Do not specify environment variables or ellipses in the path. Also, do not specify a placeholder for the user name because the user name will be appended at logon.
|
||||
|
||||
> [!NOTE]
|
||||
> The Drive letter box is ignored if you choose “On the local computer” from the Location list. If you choose “On the local computer” and enter a file share, the user's home folder will be placed in the network location without mapping the file share to a drive letter.
|
||||
|
||||
If you disable or do not configure this policy setting, the user's home folder is configured as specified in the user's Active Directory Domain Services account.
|
||||
|
||||
If the "Set Remote Desktop Services User Home Directory" policy setting is enabled, the “Set user home folder” policy setting has no effect.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Set user home folder*
|
||||
- GP name: *USER_HOME*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-userprofiles-userinfoaccessaction"></a>**ADMX_UserProfiles/UserInfoAccessAction**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This setting prevents users from managing the ability to allow apps to access the user name, account picture, and domain information.
|
||||
|
||||
If you enable this policy setting, sharing of user name, picture and domain information may be controlled by setting one of the following options:
|
||||
|
||||
- "Always on" - users will not be able to change this setting and the user's name and account picture will be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will also be able to retrieve the user's UPN, SIP/URI, and DNS.
|
||||
|
||||
- "Always off" - users will not be able to change this setting and the user's name and account picture will not be shared with apps (not desktop apps). In addition apps (not desktop apps) that have the enterprise authentication capability will not be able to retrieve the user's UPN, SIP/URI, and DNS. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources.
|
||||
|
||||
If you do not configure or disable this policy the user will have full control over this setting and can turn it off and on. Selecting this option may have a negative impact on certain enterprise software and/or line of business apps that depend on the domain information protected by this setting to connect with network resources if users choose to turn the setting off.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *User management of sharing user name, account picture, and domain information with apps (not desktop apps)*
|
||||
- GP name: *UserInfoAccessAction*
|
||||
- GP path: *System\User Profiles*
|
||||
- GP ADMX file name: *UserProfiles.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
493
windows/client-management/mdm/policy-csp-admx-winlogon.md
Normal file
493
windows/client-management/mdm/policy-csp-admx-winlogon.md
Normal file
@ -0,0 +1,493 @@
|
||||
---
|
||||
title: Policy CSP - ADMX_WinLogon
|
||||
description: Policy CSP - ADMX_WinLogon
|
||||
ms.author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.date: 11/09/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Policy CSP - ADMX_WinLogon
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policies-->
|
||||
## ADMX_WinLogon policies
|
||||
|
||||
<dl>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-customshell">ADMX_WinLogon/CustomShell</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-displaylastlogoninfodescription">ADMX_WinLogon/DisplayLastLogonInfoDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-logonhoursnotificationpolicydescription">ADMX_WinLogon/LogonHoursNotificationPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-logonhourspolicydescription">ADMX_WinLogon/LogonHoursPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-reportcachedlogonpolicydescription">ADMX_WinLogon/ReportCachedLogonPolicyDescription</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#admx-winlogon-softwaresasgeneration">ADMX_WinLogon/SoftwareSASGeneration</a>
|
||||
</dd>
|
||||
</dl>
|
||||
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-customshell"></a>**ADMX_WinLogon/CustomShell**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. Specifies an alternate user interface. The Explorer program (%windir%\explorer.exe) creates the familiar Windows interface, but you can use this setting to specify an alternate interface.
|
||||
|
||||
If you enable this setting, the system starts the interface you specify instead of Explorer.exe. To use this setting, copy your interface program to a network share or to your system drive. Then, enable this setting, and type the name of the interface program, including the file name extension, in the Shell name text box. If the interface program file is not located in a folder specified in the Path environment variable for your system, enter the fully qualified path to the file.
|
||||
|
||||
If you disable this setting or do not configure it, the setting is ignored and the system displays the Explorer interface.
|
||||
|
||||
> [!TIP]
|
||||
> To find the folders indicated by the Path environment variable, click System Properties in Control Panel, click the Advanced tab, click the Environment Variables button, and then, in the System variables box, click Path.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Custom User Interface*
|
||||
- GP name: *CustomShell*
|
||||
- GP path: *System*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-displaylastlogoninfodescription"></a>**ADMX_WinLogon/DisplayLastLogonInfoDescription**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not the system displays information about previous logons and logon failures to the user.
|
||||
|
||||
For local user accounts and domain user accounts in domains of at least a Windows Server 2008 functional level, if you enable this setting, a message appears after the user logs on that displays the date and time of the last successful logon by that user, the date and time of the last unsuccessful logon attempted with that user name, and the number of unsuccessful logons since the last successful logon by that user. This message must be acknowledged by the user before the user is presented with the Microsoft Windows desktop.
|
||||
|
||||
For domain user accounts in Windows Server 2003, Windows 2000 native, or Windows 2000 mixed functional level domains, if you enable this setting, a warning message will appear that Windows could not retrieve the information and the user will not be able to log on. Therefore, you should not enable this policy setting if the domain is not at the Windows Server 2008 domain functional level.
|
||||
|
||||
If you disable or do not configure this setting, messages about the previous logon or logon failures are not displayed.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Display information about previous logons during user logon*
|
||||
- GP name: *DisplayLastLogonInfoDescription*
|
||||
- GP path: *Windows Components\Windows Logon Options*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-logonhoursnotificationpolicydescription"></a>**ADMX_WinLogon/LogonHoursNotificationPolicyDescription**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified when his logon hours are about to expire. By default, a user is notified before logon hours expire, if actions have been set to occur when the logon hours expire.
|
||||
|
||||
If you enable this setting, warnings are not displayed to the user before the logon hours expire.
|
||||
|
||||
If you disable or do not configure this setting, users receive warnings before the logon hours expire, if actions have been set to occur when the logon hours expire.
|
||||
|
||||
> [!NOTE]
|
||||
> If you configure this setting, you might want to examine and appropriately configure the “Set action to take when logon hours expire” setting. If “Set action to take when logon hours expire” is disabled or not configured, the “Remove logon hours expiration warnings” setting will have no effect, and users receive no warnings about logon hour expiration
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Remove logon hours expiration warnings*
|
||||
- GP name: *LogonHoursNotificationPolicyDescription*
|
||||
- GP path: *Windows Components\Windows Logon Options*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-logonhourspolicydescription"></a>**ADMX_WinLogon/LogonHoursPolicyDescription**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy controls which action will be taken when the logon hours expire for the logged on user. The actions include lock the workstation, disconnect the user, or log the user off completely.
|
||||
|
||||
If you choose to lock or disconnect a session, the user cannot unlock the session or reconnect except during permitted logon hours.
|
||||
|
||||
If you choose to log off a user, the user cannot log on again except during permitted logon hours. If you choose to log off a user, the user might lose unsaved data. If you enable this setting, the system will perform the action you specify when the user’s logon hours expire.
|
||||
|
||||
If you disable or do not configure this setting, the system takes no action when the user’s logon hours expire. The user can continue the existing session, but cannot log on to a new session.
|
||||
|
||||
> [!NOTE]
|
||||
> If you configure this setting, you might want to examine and appropriately configure the “Remove logon hours expiration warnings” setting.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Set action to take when logon hours expire*
|
||||
- GP name: *LogonHoursPolicyDescription*
|
||||
- GP path: *Windows Components\Windows Logon Options*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-reportcachedlogonpolicydescription"></a>**ADMX_WinLogon/ReportCachedLogonPolicyDescription**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
> * User
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy controls whether the logged on user should be notified if the logon server could not be contacted during logon and he has been logged on using previously stored account information.
|
||||
|
||||
If enabled, a notification popup will be displayed to the user when the user logs on with cached credentials.
|
||||
|
||||
If disabled or not configured, no popup will be displayed to the user.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Report when logon server was not available during user logon*
|
||||
- GP name: *ReportCachedLogonPolicyDescription*
|
||||
- GP path: *Windows Components\Windows Logon Options*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="admx-winlogon-softwaresasgeneration"></a>**ADMX_WinLogon/SoftwareSASGeneration**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not software can simulate the Secure Attention Sequence (SAS).
|
||||
|
||||
If you enable this policy setting, you have one of four options:
|
||||
|
||||
- If you set this policy setting to "None," user mode software cannot simulate the SAS.
|
||||
- If you set this policy setting to "Services," services can simulate the SAS.
|
||||
- If you set this policy setting to "Ease of Access applications," Ease of Access applications can simulate the SAS.
|
||||
- If you set this policy setting to "Services and Ease of Access applications," both services and Ease of Access applications can simulate the SAS.
|
||||
|
||||
If you disable or do not configure this setting, only Ease of Access applications running on the secure desktop can simulate the SAS.
|
||||
|
||||
<!--/Description-->
|
||||
> [!TIP]
|
||||
> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md).
|
||||
>
|
||||
> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy).
|
||||
>
|
||||
> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
|
||||
|
||||
<!--ADMXBacked-->
|
||||
ADMX Info:
|
||||
- GP English name: *Disable or enable software Secure Attention Sequence*
|
||||
- GP name: *SoftwareSASGeneration*
|
||||
- GP path: *Windows Components\Windows Logon Options*
|
||||
- GP ADMX file name: *WinLogon.admx*
|
||||
|
||||
<!--/ADMXBacked-->
|
||||
<!--/Policy-->
|
||||
<hr/>
|
||||
|
||||
Footnotes:
|
||||
|
||||
- 1 - Available in Windows 10, version 1607.
|
||||
- 2 - Available in Windows 10, version 1703.
|
||||
- 3 - Available in Windows 10, version 1709.
|
||||
- 4 - Available in Windows 10, version 1803.
|
||||
- 5 - Available in Windows 10, version 1809.
|
||||
- 6 - Available in Windows 10, version 1903.
|
||||
- 7 - Available in Windows 10, version 1909.
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
@ -19,7 +19,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is
|
||||
> [!NOTE]
|
||||
> Network Monitor is the archived protocol analyzer and is no longer under development. **Microsoft Message Analyzer** is the replacement for Network Monitor. For more details, see [Microsoft Message Analyzer Operating Guide](https://docs.microsoft.com/message-analyzer/microsoft-message-analyzer-operating-guide).
|
||||
|
||||
To get started, [download and run NM34_x64.exe](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image.
|
||||
To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image:
|
||||
|
||||
|
||||
|
||||
|
||||
@ -65,7 +65,7 @@ For information about setting up Delivery Optimization, including tips for the b
|
||||
- Office installations and updates
|
||||
- Xbox game pass games
|
||||
- MSIX apps (HTTP downloads only)
|
||||
|
||||
- Edge browser installations and updates
|
||||
|
||||
## Requirements
|
||||
|
||||
|
||||
@ -8,10 +8,10 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: high
|
||||
audience: ITPro
|
||||
author: medgarmedgar
|
||||
author: robsize
|
||||
ms.author: dansimp
|
||||
manager: robsize
|
||||
ms.date: 3/25/2020
|
||||
ms.date: 12/1/2020
|
||||
---
|
||||
|
||||
# Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server
|
||||
|
||||
@ -456,4 +456,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
@ -461,4 +461,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
@ -15,6 +15,7 @@ ms.topic: article
|
||||
ms.date: 6/26/2018
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Manage connection endpoints for Windows 10 Enterprise, version 1809
|
||||
|
||||
**Applies to**
|
||||
@ -30,17 +31,17 @@ Some Windows components, app, and related services transfer data to Microsoft ne
|
||||
- Using your location to show a weather forecast.
|
||||
|
||||
This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later.
|
||||
Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
||||
Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it.
|
||||
Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
|
||||
Where applicable, each endpoint covered in this topic includes a link to specific details about how to control traffic to it.
|
||||
|
||||
We used the following methodology to derive these network endpoints:
|
||||
|
||||
1. Set up the latest version of Windows 10 on a test virtual machine using the default settings.
|
||||
1. Set up the latest version of Windows 10 on a test virtual machine using the default settings.
|
||||
2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
|
||||
3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
|
||||
3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
|
||||
4. Compile reports on traffic going to public IP addresses.
|
||||
5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
|
||||
6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here.
|
||||
5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
|
||||
6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here.
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
|
||||
@ -49,70 +50,70 @@ We used the following methodology to derive these network endpoints:
|
||||
|
||||
## Apps
|
||||
|
||||
The following endpoint is used to download updates to the Weather app Live Tile.
|
||||
The following endpoint is used to download updates to the Weather app Live Tile.
|
||||
If you [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), no Live Tiles will be updated.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
| explorer | HTTP | tile-service.weather.microsoft.com |
|
||||
|:--------------:|:--------:|:------------|
|
||||
| explorer | HTTP | tile-service.weather.microsoft.com |
|
||||
| | HTTP | blob.weather.microsoft.com |
|
||||
|
||||
The following endpoint is used for OneNote Live Tile.
|
||||
To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoint is used for OneNote Live Tile.
|
||||
To turn off traffic for this endpoint, either uninstall OneNote or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | cdn.onenote.net/livetile/?Language=en-US |
|
||||
|
||||
The following endpoints are used for Twitter updates.
|
||||
To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoints are used for Twitter updates.
|
||||
To turn off traffic for these endpoints, either uninstall Twitter or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | wildcard.twimg.com |
|
||||
| svchost.exe | | oem.twimg.com/windows/tile.xml |
|
||||
|
||||
The following endpoint is used for Facebook updates.
|
||||
To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoint is used for Facebook updates.
|
||||
To turn off traffic for this endpoint, either uninstall Facebook or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | star-mini.c10r.facebook.com |
|
||||
|
||||
The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office.
|
||||
To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoint is used by the Photos app to download configuration files, and to connect to the Microsoft 365 admin center's shared infrastructure, including Office.
|
||||
To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| WindowsApps\Microsoft.Windows.Photos | HTTPS | evoke-windowsservices-tas.msedge.net |
|
||||
|
||||
The following endpoint is used for Candy Crush Saga updates.
|
||||
To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoint is used for Candy Crush Saga updates.
|
||||
To turn off traffic for this endpoint, either uninstall Candy Crush Saga or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | TLS v1.2 | candycrushsoda.king.com |
|
||||
|
||||
The following endpoint is used for by the Microsoft Wallet app.
|
||||
To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
The following endpoint is used for by the Microsoft Wallet app.
|
||||
To turn off traffic for this endpoint, either uninstall the Wallet app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
If you disable the Microsoft store, other Store apps cannot be installed or updated.
|
||||
Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| system32\AppHostRegistrationVerifier.exe | HTTPS | wallet.microsoft.com |
|
||||
|
||||
The following endpoint is used by the Groove Music app for update HTTP handler status.
|
||||
The following endpoint is used by the Groove Music app for update HTTP handler status.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-apps-for-websites), apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
@ -123,7 +124,7 @@ The following endpoints are used when using the Whiteboard app.
|
||||
To turn off traffic for this endpoint [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | wbd.ms |
|
||||
| | HTTPS | int.whiteboard.microsoft.com |
|
||||
| | HTTPS | whiteboard.microsoft.com |
|
||||
@ -135,28 +136,28 @@ The following endpoint is used to get images that are used for Microsoft Store s
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block images that are used for Microsoft Store suggestions.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| searchui | HTTPS |store-images.s-microsoft.com |
|
||||
|
||||
The following endpoint is used to update Cortana greetings, tips, and Live Tiles.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), you will block updates to Cortana greetings, tips, and Live Tiles.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| backgroundtaskhost | HTTPS | www.bing.com/client |
|
||||
|
||||
The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments.
|
||||
The following endpoint is used to configure parameters, such as how often the Live Tile is updated. It's also used to activate experiments.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), parameters would not be updated and the device would no longer participate in experiments.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| backgroundtaskhost | HTTPS | www.bing.com/proactive |
|
||||
|
||||
The following endpoint is used by Cortana to report diagnostic and diagnostic data information.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana), Microsoft won't be aware of issues with Cortana and won't be able to fix them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| searchui <br> backgroundtaskhost | HTTPS | www.bing.com/threshold/xls.aspx |
|
||||
|
||||
## Certificates
|
||||
@ -164,13 +165,13 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
|
||||
The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses.
|
||||
|
||||
Additionally, it is used to download certificates that are publicly known to be fraudulent.
|
||||
These settings are critical for both Windows security and the overall security of the Internet.
|
||||
These settings are critical for both Windows security and the overall security of the Internet.
|
||||
We do not recommend blocking this endpoint.
|
||||
If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
| svchost | HTTP | ctldl.windowsupdate.com |
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTP | ctldl.windowsupdate.com |
|
||||
|
||||
## Device authentication
|
||||
|
||||
@ -178,7 +179,7 @@ The following endpoint is used to authenticate a device.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), the device will not be authenticated.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | login.live.com/ppsecure |
|
||||
|
||||
## Device metadata
|
||||
@ -187,7 +188,7 @@ The following endpoint is used to retrieve device metadata.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-devinst), metadata will not be updated for the device.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | dmd.metaservices.microsoft.com.akadns.net |
|
||||
| | HTTP | dmd.metaservices.microsoft.com |
|
||||
|
||||
@ -197,21 +198,21 @@ The following endpoint is used by the Connected User Experiences and Telemetry c
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | | cy2.vortex.data.microsoft.com.akadns.net |
|
||||
|
||||
The following endpoint is used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | v10.vortex-win.data.microsoft.com/collect/v1 |
|
||||
|
||||
The following endpoints are used by Windows Error Reporting.
|
||||
To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| wermgr | | watson.telemetry.microsoft.com |
|
||||
| | TLS v1.2 | modern.watson.data.microsoft.com.akadns.net |
|
||||
|
||||
@ -221,9 +222,9 @@ The following endpoints are used to download fonts on demand.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#font-streaming), you will not be able to download fonts on demand.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | | fs.microsoft.com |
|
||||
| | | fs.microsoft.com/fs/windows/config.json |
|
||||
| | | fs.microsoft.com/fs/windows/config.json |
|
||||
|
||||
## Licensing
|
||||
|
||||
@ -231,7 +232,7 @@ The following endpoint is used for online activation and some app licensing.
|
||||
To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| licensemanager | HTTPS | licensing.mp.microsoft.com/v7.0/licenses/content |
|
||||
|
||||
## Location
|
||||
@ -240,7 +241,7 @@ The following endpoint is used for location data.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location), apps cannot use location data.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTP | location-inference-westus.cloudapp.net |
|
||||
| | HTTPS | inference.location.live.net |
|
||||
|
||||
@ -250,16 +251,16 @@ The following endpoint is used to check for updates to maps that have been downl
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps), offline maps will not be updated.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
| svchost | HTTPS | *g.akamaiedge.net |
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | *g.akamaiedge.net |
|
||||
|
||||
## Microsoft account
|
||||
|
||||
The following endpoints are used for Microsoft accounts to sign in.
|
||||
The following endpoints are used for Microsoft accounts to sign in.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account), users cannot sign in with Microsoft accounts.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | login.msa.akadns6.net |
|
||||
| | | login.live.com |
|
||||
| | | account.live.com |
|
||||
@ -272,29 +273,29 @@ The following endpoint is used for the Windows Push Notification Services (WNS).
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#live-tiles), push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | *.wns.windows.com |
|
||||
|
||||
The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.
|
||||
The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.
|
||||
To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTP | storecatalogrevocation.storequality.microsoft.com |
|
||||
|
||||
The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
|
||||
The following endpoints are used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | img-prod-cms-rt-microsoft-com.akamaized.net |
|
||||
| backgroundtransferhost | HTTPS | store-images.microsoft.com |
|
||||
|
||||
The following endpoints are used to communicate with Microsoft Store.
|
||||
The following endpoints are used to communicate with Microsoft Store.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore), apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTP | storeedgefd.dsx.mp.microsoft.com |
|
||||
| | HTTP \ HTTPS | pti.store.microsoft.com |
|
||||
||TLS v1.2|cy2.\*.md.mp.microsoft.com.\*.|
|
||||
@ -302,48 +303,48 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op
|
||||
|
||||
## Network Connection Status Indicator (NCSI)
|
||||
|
||||
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.
|
||||
Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi), NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTP | www.msftconnecttest.com/connecttest.txt |
|
||||
|
||||
## Office
|
||||
|
||||
The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
|
||||
The following endpoints are used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
|
||||
You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
|
||||
If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
| | | *.a-msedge.net |
|
||||
| hxstr | | *.c-msedge.net |
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | *.a-msedge.net |
|
||||
| hxstr | | *.c-msedge.net |
|
||||
| | | *.e-msedge.net |
|
||||
| | | *.s-msedge.net |
|
||||
| | HTTPS | ocos-office365-s2s.msedge.net |
|
||||
| | HTTPS | nexusrules.officeapps.live.com |
|
||||
| | HTTPS | officeclient.microsoft.com |
|
||||
|
||||
The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
|
||||
The following endpoint is used to connect to the Microsoft 365 admin center's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity).
|
||||
You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
|
||||
If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| system32\Auth.Host.exe | HTTPS | outlook.office365.com |
|
||||
|
||||
The following endpoint is OfficeHub traffic used to get the metadata of Office apps. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
|Windows Apps\Microsoft.Windows.Photos|HTTPS|client-office365-tas.msedge.net|
|
||||
|
||||
The following endpoint is used to connect the Office To-Do app to it's cloud service.
|
||||
To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| |HTTPS|to-do.microsoft.com|
|
||||
|
||||
## OneDrive
|
||||
@ -352,15 +353,15 @@ The following endpoint is a redirection service that’s used to automatically u
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive), anything that relies on g.live.com to get updated URL information will no longer work.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| onedrive | HTTP \ HTTPS | g.live.com/1rewlive5skydrive/ODSUProduction |
|
||||
|
||||
The following endpoint is used by OneDrive for Business to download and verify app updates. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US).
|
||||
To turn off traffic for this endpoint, uninstall OneDrive for Business. In this case, your device will not able to get OneDrive for Business app updates.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
| onedrive | HTTPS | oneclient.sfx.ms |
|
||||
|:--------------:|:--------:|:------------|
|
||||
| onedrive | HTTPS | oneclient.sfx.ms |
|
||||
|
||||
## Settings
|
||||
|
||||
@ -368,21 +369,21 @@ The following endpoint is used as a way for apps to dynamically update their con
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| dmclient | | cy2.settings.data.microsoft.com.akadns.net |
|
||||
|
||||
The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| dmclient | HTTPS | settings.data.microsoft.com |
|
||||
|
||||
The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as Windows Connected User Experiences and Telemetry component and Windows Insider Program use it.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback), an app that uses this endpoint may stop working.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | settings-win.data.microsoft.com |
|
||||
|
||||
## Skype
|
||||
@ -390,7 +391,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
|
||||
The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
|microsoft.windowscommunicationsapps.exe | HTTPS | config.edge.skype.com |
|
||||
| | HTTPS | browser.pipe.aria.microsoft.com |
|
||||
| | | skypeecs-prod-usw-0-b.cloudapp.net |
|
||||
@ -401,14 +402,14 @@ The following endpoint is used for Windows Defender when Cloud-based Protection
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Microsoft Defender Antivirus cloud service connections, see [Allow connections to the Microsoft Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-network-connections-microsoft-defender-antivirus#allow-connections-to-the-microsoft-defender-antivirus-cloud-service).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | wdcp.microsoft.com |
|
||||
|
||||
The following endpoints are used for Windows Defender definition updates.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), definitions will not be updated.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | | definitionupdates.microsoft.com |
|
||||
|MpCmdRun.exe|HTTPS|go.microsoft.com |
|
||||
|
||||
@ -416,10 +417,10 @@ The following endpoints are used for Windows Defender Smartscreen reporting and
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| | HTTPS | ars.smartscreen.microsoft.com |
|
||||
| | HTTPS | unitedstates.smartscreen-prod.microsoft.com |
|
||||
| | | smartscreen-sn3p.smartscreen.microsoft.com |
|
||||
| | | smartscreen-sn3p.smartscreen.microsoft.com |
|
||||
|
||||
## Windows Spotlight
|
||||
|
||||
@ -427,7 +428,7 @@ The following endpoints are used to retrieve Windows Spotlight metadata that des
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight), Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see [Windows Spotlight](/windows/configuration/windows-spotlight).
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| backgroundtaskhost | HTTPS | arc.msn.com |
|
||||
| backgroundtaskhost | | g.msn.com.nsatc.net |
|
||||
| |TLS v1.2| *.search.msn.com |
|
||||
@ -440,22 +441,22 @@ The following endpoint is used for Windows Update downloads of apps and OS updat
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | *.prod.do.dsp.mp.microsoft.com |
|
||||
|
||||
The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.
|
||||
The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTP | *.windowsupdate.com |
|
||||
| svchost | HTTP | *.dl.delivery.mp.microsoft.com |
|
||||
|
||||
The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store.
|
||||
The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store.
|
||||
If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | *.update.microsoft.com |
|
||||
| svchost | HTTPS | *.delivery.mp.microsoft.com |
|
||||
|
||||
@ -467,7 +468,7 @@ The following endpoint is used for content regulation.
|
||||
If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|:--------------:|:--------:|:------------|
|
||||
| svchost | HTTPS | tsfe.trafficshaping.dsp.mp.microsoft.com |
|
||||
|
||||
|
||||
@ -478,7 +479,7 @@ The following endpoint is used by the Microsoft forward link redirection service
|
||||
If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.
|
||||
|
||||
| Source process | Protocol | Destination |
|
||||
|----------------|----------|------------|
|
||||
|----------------|:--------:|------------|
|
||||
|Various|HTTPS|go.microsoft.com|
|
||||
|
||||
## Other Windows 10 editions
|
||||
@ -496,4 +497,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
@ -187,6 +187,6 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
|
||||
|
||||
@ -138,4 +138,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.localizationpriority: high
|
||||
audience: ITPro
|
||||
author: linque1
|
||||
ms.author: obezeajo
|
||||
ms.author: robsize
|
||||
manager: robsize
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
@ -137,4 +137,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
|
||||
## Related links
|
||||
|
||||
- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
|
||||
- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints)
|
||||
|
||||
@ -576,7 +576,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn Local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -645,7 +645,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn Local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -717,7 +717,7 @@ This security group includes the following changes since Windows Server 2008:
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn Local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -865,7 +865,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -987,7 +987,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-517</p></td>
|
||||
<td><p>S-1-5-21-<domain>-517</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1113,7 +1113,7 @@ This security group was introduced in Windows Vista Service Pack 1, and it h
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1241,7 +1241,7 @@ The Device Owners group applies to versions of the Windows Server operating syst
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn Local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1430,7 +1430,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Domain local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1493,7 +1493,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Domain Global</p></td>
|
||||
<td><p>Global</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1552,7 +1552,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-515</p></td>
|
||||
<td><p>S-1-5-21-<domain>-515</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1613,7 +1613,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-516</p></td>
|
||||
<td><p>S-1-5-21-<domain>-516</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1674,7 +1674,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-514</p></td>
|
||||
<td><p>S-1-5-21-<domain>-514</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1737,11 +1737,11 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-513</p></td>
|
||||
<td><p>S-1-5-21-<domain>-513</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Domain Global</p></td>
|
||||
<td><p>Global</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1950,7 +1950,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Domain Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -1985,13 +1985,13 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
|
||||
|
||||
### <a href="" id="bkmk-gpcreatorsowners"></a>Group Policy Creators Owners
|
||||
### <a href="" id="bkmk-gpcreatorsowners"></a>Group Policy Creator Owners
|
||||
|
||||
This group is authorized to create, edit, or delete Group Policy Objects in the domain. By default, the only member of the group is Administrator.
|
||||
|
||||
For information about other features you can use with this security group, see [Group Policy Overview](https://technet.microsoft.com/library/hh831791.aspx).
|
||||
|
||||
The Group Policy Creators Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
The Group Policy Creator Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable).
|
||||
|
||||
This security group has not changed since Windows Server 2008.
|
||||
|
||||
@ -2009,7 +2009,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<domain>-520</p></td>
|
||||
<td><p>S-1-5-21-<domain>-520</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -2093,12 +2093,11 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Default members</p></td>
|
||||
<td><p>Guest</p></td>
|
||||
<td><p><a href="#bkmk-domainguests" data-raw-source="[Domain Guests](#bkmk-domainguests)">Domain Guests</a></p><p>Guest</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p><a href="#bkmk-domainguests" data-raw-source="[Domain Guests](#bkmk-domainguests)">Domain Guests</a></p>
|
||||
<p>Guest</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
@ -2150,7 +2149,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2162,7 +2161,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
@ -2211,7 +2210,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn Local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2286,7 +2285,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2389,7 +2388,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>BuiltIn local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2470,7 +2469,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2551,7 +2550,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2615,7 +2614,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2679,7 +2678,7 @@ This security group has not changed since Windows Server 2008. However, in Windo
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2758,7 +2757,7 @@ The following table specifies the properties of the Protected Users group.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Domain Global</p></td>
|
||||
<td><p>Global</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2819,7 +2818,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Domain local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2876,11 +2875,11 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-32-<domain>-576</p></td>
|
||||
<td><p>S-1-5-32-576</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -2939,7 +2938,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3000,7 +2999,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3035,6 +3034,78 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
|
||||
|
||||
|
||||
### <a href="" id="bkmk-rodc"></a>Read-Only Domain Controllers
|
||||
|
||||
This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role.
|
||||
|
||||
Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality:
|
||||
|
||||
- Read-only AD DS database
|
||||
|
||||
- Unidirectional replication
|
||||
|
||||
- Credential caching
|
||||
|
||||
- Administrator role separation
|
||||
|
||||
- Read-only Domain Name System (DNS)
|
||||
|
||||
For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Attribute</th>
|
||||
<th>Value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-21-<domain>-521</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Global</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
<td><p>CN=Users, DC=<domain>, DC=</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Default members</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p><a href="#bkmk-deniedrodcpwdrepl" data-raw-source="[Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)">Denied RODC Password Replication Group</a></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Safe to move out of default container?</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Safe to delegate management of this group to non-Service admins?</p></td>
|
||||
<td><p></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default User Rights</p></td>
|
||||
<td><p>See <a href="#bkmk-deniedrodcpwdrepl" data-raw-source="[Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)">Denied RODC Password Replication Group</a></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
### <a href="" id="bkmk-remotedesktopusers"></a>Remote Desktop Users
|
||||
|
||||
The Remote Desktop Users group on an RD Session Host server is used to grant users and groups permissions to remotely connect to an RD Session Host server. This group cannot be renamed, deleted, or moved. It appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO).
|
||||
@ -3094,78 +3165,6 @@ This security group has not changed since Windows Server 2008.
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
### <a href="" id="bkmk-rodc"></a>Read-Only Domain Controllers
|
||||
|
||||
This group is comprised of the Read-only domain controllers in the domain. A Read-only domain controller makes it possible for organizations to easily deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as in an extranet or in an application-facing role.
|
||||
|
||||
Because administration of a Read-only domain controller can be delegated to a domain user or security group, an Read-only domain controller is well suited for a site that should not have a user who is a member of the Domain Admins group. A Read-only domain controller encompasses the following functionality:
|
||||
|
||||
- Read-only AD DS database
|
||||
|
||||
- Unidirectional replication
|
||||
|
||||
- Credential caching
|
||||
|
||||
- Administrator role separation
|
||||
|
||||
- Read-only Domain Name System (DNS)
|
||||
|
||||
For information about deploying a Read-only domain controller, see [Understanding Planning and Deployment for Read-Only Domain Controllers](https://technet.microsoft.com/library/cc754719(v=ws.10).aspx).
|
||||
|
||||
This security group was introduced in Windows Server 2008, and it has not changed in subsequent versions.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Attribute</th>
|
||||
<th>Value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-21-<domain>-521</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
<td><p>CN=Users, DC=<domain>, DC=</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Default members</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p><a href="#bkmk-deniedrodcpwdrepl" data-raw-source="[Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)">Denied RODC Password Replication Group</a></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Safe to move out of default container?</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Safe to delegate management of this group to non-Service admins?</p></td>
|
||||
<td><p></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default User Rights</p></td>
|
||||
<td><p>See <a href="#bkmk-deniedrodcpwdrepl" data-raw-source="[Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)">Denied RODC Password Replication Group</a></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
@ -3197,7 +3196,7 @@ This security group was introduced in Windows Server 2012, and it has not chang
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3264,7 +3263,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3327,7 +3326,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-<root domain>-518</p></td>
|
||||
<td><p>S-1-5-21-<root domain>-518</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -3394,7 +3393,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3442,7 +3441,7 @@ The Storage Replica Administrators group applies to versions of the Windows Serv
|
||||
| Attribute | Value |
|
||||
|-----------|-------|
|
||||
| Well-Known SID/RID | S-1-5-32-582 |
|
||||
| Type | BuiltIn Local |
|
||||
| Type | Builtin Local |
|
||||
| Default container | CN=BuiltIn, DC=<domain>, DC= |
|
||||
| Default members | None |
|
||||
| Default member of | None |
|
||||
@ -3463,7 +3462,7 @@ The System Managed Accounts group applies to versions of the Windows Server oper
|
||||
| Attribute | Value |
|
||||
|-----------|-------|
|
||||
| Well-Known SID/RID | S-1-5-32-581 |
|
||||
| Type | BuiltIn Local |
|
||||
| Type | Builtin Local |
|
||||
| Default container | CN=BuiltIn, DC=<domain>, DC= |
|
||||
| Default members | Users |
|
||||
| Default member of | None |
|
||||
@ -3507,7 +3506,7 @@ This security group only applies to Windows Server 2003 and Windows Server 200
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3574,7 +3573,7 @@ This security group includes the following changes since Windows Server 2008:
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
@ -3588,7 +3587,7 @@ This security group includes the following changes since Windows Server 2008:
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default member of</p></td>
|
||||
<td><p>Domain Users (this membership is due to the fact that the Primary Group ID of all user accounts is Domain Users.)</p></td>
|
||||
<td><p>None</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Protected by ADMINSDHOLDER?</p></td>
|
||||
@ -3641,7 +3640,7 @@ This security group has not changed since Windows Server 2008.
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
<td><p>Builtin local</p></td>
|
||||
<td><p>Builtin Local</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Default container</p></td>
|
||||
|
||||
@ -68,7 +68,7 @@ If the error occurs again, check the error code against the following table to s
|
||||
| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed. <br><br> -or- <br><br> Token was not found in the Authorization header. <br><br> -or- <br><br> Failed to read one or more objects. <br><br> -or- <br><br> The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
|
||||
| 0x801C03EE | Attestation failed. | Sign out and then sign in again. |
|
||||
| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. |
|
||||
| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync).
|
||||
| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue, refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). Also, if no sync conflict exists, please verify that the "Mail/Email address" in AAD and the Primary SMTP address are the same in the proxy address.
|
||||
| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. |
|
||||
| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. |
|
||||
| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. |
|
||||
|
||||
@ -32,7 +32,7 @@ In a mobile-first, cloud-first world, Azure Active Directory enables single sign
|
||||
To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access.
|
||||
|
||||
> [!NOTE]
|
||||
> For more details about the way Windows Hello for Business interacts with Azure Multi Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032).
|
||||
> For more details about the way Windows Hello for Business interacts with Azure AD Multi-Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032).
|
||||
|
||||
Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access.
|
||||
|
||||
|
||||
@ -100,12 +100,12 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h
|
||||
## Multifactor Authentication Services
|
||||
Windows Hello for Business uses multi-factor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multi-factor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA
|
||||
|
||||
Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works.
|
||||
Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works.
|
||||
|
||||
### Azure Multi-Factor Authentication (MFA) Cloud ###
|
||||
### Azure AD Multi-Factor Authentication (MFA) Cloud ###
|
||||
> [!IMPORTANT]
|
||||
> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are:
|
||||
> * Azure Multi-Factor Authentication
|
||||
> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are:
|
||||
> * Azure AD Multi-Factor Authentication
|
||||
> * Azure Active Directory Premium
|
||||
> * Enterprise Mobility + Security
|
||||
>
|
||||
@ -115,7 +115,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co
|
||||
If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant.
|
||||
|
||||
#### Configure Azure MFA Settings ####
|
||||
Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
|
||||
#### Azure MFA User States ####
|
||||
After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users.
|
||||
@ -126,12 +126,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Review the overview and uses of Azure Multifactor Authentication.
|
||||
> * Review your Azure Active Directory subscription for Azure Multifactor Authentication.
|
||||
> * Create an Azure Multifactor Authentication Provider, if necessary.
|
||||
> * Configure Azure Multifactor Authentication features and settings.
|
||||
> * Understand the different User States and their effect on Azure Multifactor Authentication.
|
||||
> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary.
|
||||
> * Review the overview and uses of Azure AD Multi-Factor Authentication.
|
||||
> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication.
|
||||
> * Create an Azure AD Multi-Factor Authentication Provider, if necessary.
|
||||
> * Configure Azure AD Multi-Factor Authentication features and settings.
|
||||
> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication Authentication.
|
||||
> * Consider using Azure AD Multi-Factor Authentication Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary.
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md)
|
||||
|
||||
@ -110,13 +110,13 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h
|
||||
## Multifactor Authentication Services
|
||||
Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter
|
||||
|
||||
Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works.
|
||||
Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works.
|
||||
|
||||
### Azure Multi-Factor Authentication (MFA) Cloud
|
||||
### Azure AD Multi-Factor Authentication Authentication (MFA) Cloud
|
||||
|
||||
> [!IMPORTANT]
|
||||
> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are:
|
||||
> * Azure Multi-Factor Authentication
|
||||
> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are:
|
||||
> * Azure AD Multi-Factor Authentication
|
||||
> * Azure Active Directory Premium
|
||||
> * Enterprise Mobility + Security
|
||||
>
|
||||
@ -124,7 +124,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co
|
||||
|
||||
|
||||
#### Configure Azure MFA Settings
|
||||
Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings.
|
||||
|
||||
#### Azure MFA User States
|
||||
After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users.
|
||||
@ -135,12 +135,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
> * Review the overview and uses of Azure Multifactor Authentication.
|
||||
> * Review your Azure Active Directory subscription for Azure Multifactor Authentication.
|
||||
> * Create an Azure Multifactor Authentication Provider, if necessary.
|
||||
> * Configure Azure Multifactor Authentication features and settings.
|
||||
> * Understand the different User States and their effect on Azure Multifactor Authentication.
|
||||
> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary.
|
||||
> * Review the overview and uses of Azure AD Multi-Factor Authentication.
|
||||
> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication.
|
||||
> * Create an Azure AD Multi-Factor Authentication Provider, if necessary.
|
||||
> * Configure Azure AD Multi-Factor Authentication features and settings.
|
||||
> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication.
|
||||
> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary.
|
||||
|
||||
> [!div class="nextstepaction"]
|
||||
> [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md)
|
||||
|
||||
@ -33,6 +33,7 @@ Windows Hello addresses the following problems with passwords:
|
||||
> | | | |
|
||||
> | :---: | :---: | :---: |
|
||||
> | [](hello-overview.md)</br>[Overview](hello-overview.md) | [](hello-why-pin-is-better-than-password.md)</br>[Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [](hello-manage-in-organization.md)</br>[Manage Windows Hello in your Organization](hello-manage-in-organization.md) |
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
@ -41,7 +42,7 @@ Windows Hello addresses the following problems with passwords:
|
||||
* Windows 10, version 1511 or later
|
||||
* Microsoft Azure Account
|
||||
* Azure Active Directory
|
||||
* Azure Multi-factor authentication
|
||||
* Azure AD Multi-Factor Authentication
|
||||
* Modern Management (Intune or supported third-party MDM), *optional*
|
||||
* Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.reviewer:
|
||||
# Validate and Deploy Multi-factor Authentication (MFA)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual.
|
||||
> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual.
|
||||
|
||||
**Applies to**
|
||||
|
||||
|
||||
@ -106,13 +106,13 @@ The built-in Windows Hello for Business provisioning experience creates a hardwa
|
||||
#### Multifactor authentication
|
||||
|
||||
> [!IMPORTANT]
|
||||
> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details.
|
||||
> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure AD Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details.
|
||||
|
||||
The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user's weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential.
|
||||
|
||||
Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information).
|
||||
Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure AD Multi-Factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information).
|
||||
> [!NOTE]
|
||||
> Azure Multi-Factor Authentication is available through:
|
||||
> Azure AD Multi-Factor Authentication is available through:
|
||||
> * Microsoft Enterprise Agreement
|
||||
> * Open Volume License Program
|
||||
> * Cloud Solution Providers program
|
||||
|
||||
@ -74,7 +74,7 @@ The hard disk must be partitioned with at least two drives:
|
||||
- The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system.
|
||||
- The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space.
|
||||
|
||||
A fixed data volume or removable data volume cannot be marked as an active partition.
|
||||
A partition subject to encryption cannot be marked as an active partition (this applies to the operating system, fixed data, and removable data drives).
|
||||
|
||||
When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker.
|
||||
|
||||
@ -99,4 +99,3 @@ When installing the BitLocker optional component on a server you will also need
|
||||
| [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. |
|
||||
| [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.|
|
||||
| [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core |
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: BitLocker cannot encrypt a drive known TPM issues
|
||||
title: BitLocker cannot encrypt a drive known TPM issues
|
||||
description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM
|
||||
ms.reviewer: kaushika
|
||||
ms.technology: windows
|
||||
@ -16,7 +16,6 @@ ms.date: 10/18/2019
|
||||
ms.custom: bitlocker
|
||||
---
|
||||
|
||||
|
||||
# BitLocker cannot encrypt a drive: known TPM issues
|
||||
|
||||
This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues.
|
||||
@ -38,8 +37,10 @@ To resolve this issue, follow these steps:
|
||||
|
||||
1. Open an elevated PowerShell window and run the following script:
|
||||
|
||||
```ps
|
||||
$Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)}
|
||||
```powershell
|
||||
$Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm"
|
||||
$ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus
|
||||
if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)}
|
||||
```
|
||||
|
||||
1. Restart the computer. If you are prompted at the restart screen, press F12 to agree.
|
||||
@ -67,7 +68,7 @@ To resolve this issue, disable and re-enable the TPM. To do this, follow these s
|
||||
If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm).
|
||||
|
||||
> [!WARNING]
|
||||
> Clearing the TPM can cause data loss.
|
||||
> Clearing the TPM can cause data loss.
|
||||
|
||||
## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005
|
||||
|
||||
@ -79,7 +80,7 @@ The TPM did not have sufficient permissions on the TPM Devices container in Acti
|
||||
|
||||
This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10.
|
||||
|
||||
### Resolution
|
||||
### Resolution
|
||||
|
||||
To verify that you have correctly identified this issue, use one of the following methods:
|
||||
|
||||
@ -88,7 +89,7 @@ To verify that you have correctly identified this issue, use one of the followin
|
||||
|
||||
1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command:
|
||||
|
||||
```ps
|
||||
```powershell
|
||||
Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer
|
||||
```
|
||||
|
||||
@ -98,7 +99,7 @@ To verify that you have correctly identified this issue, use one of the followin
|
||||
|
||||
## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server"
|
||||
|
||||
Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy.
|
||||
Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy.
|
||||
|
||||
You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following:
|
||||
|
||||
@ -115,14 +116,14 @@ The domain and forest functional level of the environment may still be set to Wi
|
||||
To resolve this issue, follow these steps:
|
||||
|
||||
1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2.
|
||||
1. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133).
|
||||
1. In the script, modify the value of **strPathToDomain** to your domain name.
|
||||
1. Open an elevated PowerShell window, and run the following command:
|
||||
2. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133).
|
||||
3. In the script, modify the value of **strPathToDomain** to your domain name.
|
||||
4. Open an elevated PowerShell window, and run the following command:
|
||||
|
||||
```ps
|
||||
```powershell
|
||||
cscript <Path>Add-TPMSelfWriteACE.vbs
|
||||
```
|
||||
|
||||
|
||||
In this command \<*Path*> is the path to the script file.
|
||||
|
||||
For more information, see the following articles:
|
||||
|
||||
@ -106,7 +106,7 @@
|
||||
#### [Device control]()
|
||||
##### [Code integrity](device-guard/enable-virtualization-based-protection-of-code-integrity.md)
|
||||
##### [Control USB devices](device-control/control-usb-devices-using-intune.md)
|
||||
|
||||
##### [Device control report](device-control/device-control-report.md)
|
||||
|
||||
#### [Exploit protection]()
|
||||
##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md)
|
||||
@ -274,7 +274,7 @@
|
||||
#### [Overview of Microsoft Defender Advanced Threat Protection for iOS](microsoft-defender-atp/microsoft-defender-atp-ios.md)
|
||||
|
||||
#### [Deploy]()
|
||||
##### [App-based deployment](microsoft-defender-atp/ios-install.md)
|
||||
##### [Deploy Microsoft Defender for Endpoint for iOS via Intune](microsoft-defender-atp/ios-install.md)
|
||||
|
||||
#### [Configure]()
|
||||
##### [Configure iOS features](microsoft-defender-atp/ios-configure-features.md)
|
||||
@ -298,6 +298,7 @@
|
||||
##### [Set preferences](microsoft-defender-atp/linux-preferences.md)
|
||||
##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/linux-pua.md)
|
||||
##### [Schedule scans with Microsoft Defender ATP for Linux](microsoft-defender-atp/linux-schedule-scan-atp.md)
|
||||
##### [Schedule an update of the Microsoft Defender for Endpoint (Linux)](microsoft-defender-atp/linux-update-MDE-Linux.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md)
|
||||
|
||||
@ -0,0 +1,73 @@
|
||||
---
|
||||
title: Protect your organization’s data with device control
|
||||
description: Monitor your organization's data security through device control reports.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
ms.author: v-ajupudi
|
||||
author: alluthewriter
|
||||
ms.reviewer: dansimp
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
---
|
||||
# Protect your organization’s data with device control
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Microsoft Defender for Endpoint device control protects against data loss, by monitoring and controlling media use by devices in your organization, such as the use of removable storage devices and USB drives.
|
||||
|
||||
With the device control report, you can view events that relate to media usage, such as:
|
||||
|
||||
- **Audit events:** Shows the number of audit events that occur when external media is connected.
|
||||
- **Policy events:** Shows the number of policy events that occur when a device control policy is triggered.
|
||||
|
||||
> [!NOTE]
|
||||
> The audit event to track media usage is enabled by default for devices onboarded to Microsoft Defender for Endpoint.
|
||||
|
||||
## Understanding the audit events
|
||||
|
||||
The audit events include:
|
||||
|
||||
- **USB drive mount and unmount:** Audit events that are generated when a USB drive is mounted or unmounted.
|
||||
- **PnP:** Plug and Play audit events are generated when removable storage, a printer, or Bluetooth media is connected.
|
||||
|
||||
## Monitor device control security
|
||||
|
||||
Device control in Microsoft Defender for Endpoint empowers security administrators with tools that enable them to track their organization’s device control security through reports. You can find the device control report in the Microsoft 365 security center by going to **Reports > Device protection**.
|
||||
|
||||
The Device protection card on the **Reports** dashboard shows the number of audit events generated by media type, over the last 180 days.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
The **View details** button shows more media usage data in the **device control report** page.
|
||||
|
||||
The page provides a dashboard with aggregated number of events per type and a list of events. Administrators can filter on time range, media class name, and device ID.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
When you select an event, a flyout appears that shows you more information:
|
||||
|
||||
- **General details:** Date, Action mode, and the policy of this event.
|
||||
- **Media information:** Media information includes Media name, Class name, Class GUID, Device ID, Vendor ID, Volume, Serial number, and Bus type.
|
||||
- **Location details:** Device name and MDATP device ID.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
To see real-time activity for this media across the organization, select the **Open Advanced hunting** button. This includes an embedded, pre-defined query.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
To see the security of the device, select the **Open device page** button on the flyout. This button opens the device entity page.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Reporting delays
|
||||
|
||||
The device control report can have a 12-hour delay from the time a media connection occurs to the time the event is reflected in the card or in the domain list.
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 139 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 266 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 196 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 94 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 187 KiB |
@ -12,7 +12,6 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.date: 11/06/2020
|
||||
ms.date: 12/05/2020
|
||||
---
|
||||
|
||||
# Manage Microsoft Defender Antivirus updates and apply baselines
|
||||
@ -27,15 +27,14 @@ ms.date: 11/06/2020
|
||||
|
||||
There are two types of updates related to keeping Microsoft Defender Antivirus up to date:
|
||||
|
||||
- Security intelligence updates
|
||||
- Product updates
|
||||
- Security intelligence updates
|
||||
- Product updates
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques.
|
||||
> This also applies to devices where Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
|
||||
> Make sure to update your antivirus protection even if Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
|
||||
>
|
||||
> You can use the below URL to find out what are the current versions:
|
||||
> [https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info)
|
||||
> To see the most current engine, platform, and signature date, visit the [Microsoft security encyclopedia](https://www.microsoft.com/security/encyclopedia/adlpackages.aspx?action=info).
|
||||
|
||||
## Security intelligence updates
|
||||
|
||||
@ -48,6 +47,8 @@ Microsoft Defender Antivirus uses [cloud-delivered protection](utilize-microsoft
|
||||
|
||||
Cloud-delivered protection is always on and requires an active connection to the Internet to function. Security intelligence updates occur on a scheduled cadence (configurable via policy). For more information, see [Use Microsoft cloud-provided protection in Microsoft Defender Antivirus](utilize-microsoft-cloud-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
For a list of recent security intelligence updates, please visit: [Antimalware updates change log - Microsoft Security Intelligence](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes).
|
||||
|
||||
Engine updates are included with security intelligence updates and are released on a monthly cadence.
|
||||
|
||||
## Product updates
|
||||
@ -77,6 +78,22 @@ All our updates contain
|
||||
|
||||
|
||||
<details>
|
||||
<summary> November-2020 (Platform: 4.18.2011.6 | Engine: 1.1.17700.4)</summary>
|
||||
|
||||
 Security intelligence update version: **1.327.1854.0**
|
||||
 Released: **December 03, 2020**
|
||||
 Platform: **4.18.2011.6**
|
||||
 Engine: **1.1.17700.4**
|
||||
 Support phase: **Security and Critical Updates**
|
||||
|
||||
### What's new
|
||||
- Improved SmartScreen status support logging
|
||||
- Apply CPU throttling policy to manually initiated scans
|
||||
|
||||
### Known Issues
|
||||
No known issues
|
||||
<br/>
|
||||
</details><details>
|
||||
<summary> October-2020 (Platform: 4.18.2010.7 | Engine: 1.1.17600.5)</summary>
|
||||
|
||||
 Security intelligence update version: **1.327.7.0**
|
||||
@ -348,11 +365,73 @@ The below table provides the Microsoft Defender Antivirus platform and engine ve
|
||||
|
||||
Windows 10 release info: [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet).
|
||||
|
||||
## Updates for Deployment Image Servicing and Management (DISM)
|
||||
|
||||
We recommend updating your Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 OS installation images with the latest antivirus and antimalware updates. Keeping your OS installation images up to date helps avoid a gap in protection. For more information, see [Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images).
|
||||
|
||||
<details>
|
||||
<summary>1.1.2012.01</summary>
|
||||
|
||||
 Package version: **1.1.2012.01**
|
||||
 Platform version: **4.18.2010.7**
|
||||
 Engine version: **1.17600.5**
|
||||
 Signature version: **1.327.1991.0**
|
||||
|
||||
### Fixes
|
||||
- None
|
||||
|
||||
### Additional information
|
||||
- None
|
||||
<br/>
|
||||
</details><details>
|
||||
<summary>1.1.2011.02</summary>
|
||||
|
||||
 Package version: **1.1.2011.02**
|
||||
 Platform version: **4.18.2010.7**
|
||||
 Engine version: **1.17600.5**
|
||||
 Signature version: **1.327.658.0**
|
||||
|
||||
### Fixes
|
||||
- None
|
||||
|
||||
### Additional information
|
||||
- Refreshed Microsoft Defender Antivirus signatures
|
||||
<br/>
|
||||
</details><details>
|
||||
<summary>1.1.2011.01</summary>
|
||||
|
||||
 Package version: **1.1.2011.01**
|
||||
 Platform version: **4.18.2009.7**
|
||||
 Engine version: **1.17600.5**
|
||||
 Signature version: **1.327.344.0**
|
||||
|
||||
### Fixes
|
||||
- None
|
||||
|
||||
### Additional information
|
||||
- None
|
||||
<br/>
|
||||
</details><details>
|
||||
<summary>1.1.2009.10</summary>
|
||||
|
||||
 Package version: **1.1.2011.01**
|
||||
 Platform version: **4.18.2008.9**
|
||||
 Engine version: **1.17400.5**
|
||||
 Signature version: **1.327.2216.0**
|
||||
|
||||
### Fixes
|
||||
- None
|
||||
|
||||
### Additional information
|
||||
- Added support for Windows 10 RS1 or later OS install images.
|
||||
<br/>
|
||||
</details>
|
||||
|
||||
## See also
|
||||
|
||||
| Article | Description |
|
||||
|:---|:---|
|
||||
|[Microsoft Defender update for Windows operating system installation images](https://support.microsoft.com/help/4568292/defender-update-for-windows-operating-system-installation-images) | Review antimalware update packages for your OS installation images (WIM and VHD files). Get Microsoft Defender Antivirus updates for Windows 10 (Enterprise, Pro, and Home editions), Windows Server 2019, and Windows Server 2016 installation images. |
|
||||
|[Manage how protection updates are downloaded and applied](manage-protection-updates-microsoft-defender-antivirus.md) | Protection updates can be delivered through a number of sources. |
|
||||
|[Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-microsoft-defender-antivirus.md) | You can schedule when protection updates should be downloaded. |
|
||||
|[Manage updates for endpoints that are out of date](manage-outdated-endpoints-microsoft-defender-antivirus.md) | If an endpoint misses an update or scheduled scan, you can force an update or scan the next time a user signs in. |
|
||||
|
||||
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.date: 11/06/2020
|
||||
ms.date: 12/11/2020
|
||||
---
|
||||
|
||||
# Microsoft Defender Antivirus compatibility
|
||||
@ -72,13 +72,13 @@ The following table summarizes the functionality and features that are available
|
||||
|State |[Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) |
|
||||
|--|--|--|--|--|--|
|
||||
|Active mode <br/><br/> |Yes |No |Yes |Yes |Yes |
|
||||
|Passive mode |No |No |Yes |Only during [scheduled or on-demand scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus) |Yes |
|
||||
|Passive mode |Yes |No |Yes |Only during [scheduled or on-demand scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus) |Yes |
|
||||
|[EDR in block mode enabled](../microsoft-defender-atp/edr-in-block-mode.md) |No |No |Yes |Yes |Yes |
|
||||
|Automatic disabled mode |No |Yes |No |No |No |
|
||||
|
||||
- In Active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself).
|
||||
- In Passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on, Microsoft Defender Antivirus is not used as the primary antivirus solution, but can still detect and remediate malicious items.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not used as the primary antivirus solution, it can still detect and remediate malicious items.
|
||||
- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated.
|
||||
|
||||
## Keep the following points in mind
|
||||
@ -95,7 +95,7 @@ If you uninstall the other product, and choose to use Microsoft Defender Antivir
|
||||
> You should not attempt to disable, stop, or modify any of the associated services used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and process. Manually modifying these services can cause severe instability on your endpoints and open your network to infections and attacks. It can also cause problems when using third-party antivirus apps and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you are using [Microsoft Endpoint DLP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview), Microsoft Defender Antivirus real-time protection is enabled, even when Microsoft Defender Antivirus is running in passive mode. Endpoint DLP depends on real-time protection to operate.
|
||||
> If you are using [Microsoft Endpoint DLP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview), Microsoft Defender Antivirus real-time protection is enabled, even when Microsoft Defender Antivirus is running in passive mode. Microsoft Defender Antivirus won't conflict with third-party antivirus solutions installed on the endpoint. Endpoint DLP depends on real-time protection to operate.
|
||||
|
||||
## See also
|
||||
|
||||
@ -104,3 +104,4 @@ If you uninstall the other product, and choose to use Microsoft Defender Antivir
|
||||
- [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md)
|
||||
- [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure)
|
||||
- [Configure Endpoint Protection on a standalone client](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure-standalone-client)
|
||||
- [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 09/03/2018
|
||||
ms.date: 12/07/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -25,6 +25,8 @@ manager: dansimp
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
Microsoft Defender Antivirus is built into Windows 10, Windows Server 2019, and Windows Server 2016. Microsoft Defender Antivirus is of your next-generation protection in Microsoft Defender for Endpoint. Next-generation protection helps protect your devices from software threats like viruses, malware, and spyware across email, apps, the cloud, and the web.
|
||||
|
||||
With Microsoft Defender Antivirus, you have several options for reviewing protection status and alerts. You can use Microsoft Endpoint Configuration Manager to [monitor Microsoft Defender Antivirus](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection) or [create email alerts](https://docs.microsoft.com/configmgr/protect/deploy-use/endpoint-configure-alerts). Or, you can monitor protection using [Microsoft Intune](https://docs.microsoft.com/intune/introduction-intune).
|
||||
|
||||
Microsoft Operations Management Suite has an [Update Compliance add-in](/windows/deployment/update/update-compliance-get-started) that reports on key Microsoft Defender Antivirus issues, including protection updates and real-time protection settings.
|
||||
@ -42,5 +44,5 @@ For monitoring or determining status with PowerShell, WMI, or Microsoft Azure, s
|
||||
## Related articles
|
||||
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
|
||||
- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016)
|
||||
- [Deploy Microsoft Defender Antivirus](deploy-manage-report-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 09/07/2020
|
||||
ms.date: 12/10/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -32,21 +32,22 @@ If an employee goes to an untrusted site through either Microsoft Edge or Intern
|
||||
|
||||
Application Guard has been created to target several types of systems:
|
||||
|
||||
- **Enterprise desktops.** These desktops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network.
|
||||
- **Enterprise desktops**. These desktops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network.
|
||||
|
||||
- **Enterprise mobile laptops.** These laptops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wireless, corporate network.
|
||||
- **Enterprise mobile laptops**. These laptops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wireless, corporate network.
|
||||
|
||||
- **Bring your own device (BYOD) mobile laptops.** These personally-owned laptops are not domain-joined, but are managed by your organization through tools, such as Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home.
|
||||
- **Bring your own device (BYOD) mobile laptops**. These personally-owned laptops are not domain-joined, but are managed by your organization through tools, such as Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home.
|
||||
|
||||
- **Personal devices.** These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside.
|
||||
- **Personal devices**. These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside.
|
||||
|
||||
## Related articles
|
||||
|
||||
|Article |Description |
|
||||
|------|------------|
|
||||
|:------|:------------|
|
||||
|[System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.|
|
||||
|[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.|
|
||||
|[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.|
|
||||
|[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.|
|
||||
| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a trouble-shooting guide |
|
||||
| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide |
|
||||
| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide |
|
||||
|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.|
|
||||
|
||||
@ -109,10 +109,9 @@ list in Microsoft Defender Security Center.
|
||||
Defender for Endpoint for Android supports Android Enterprise enrolled devices.
|
||||
|
||||
For more information on the enrollment options supported by Intune, see
|
||||
[Enrollment
|
||||
Options](https://docs.microsoft.com/mem/intune/enrollment/android-enroll) .
|
||||
[Enrollment Options](https://docs.microsoft.com/mem/intune/enrollment/android-enroll).
|
||||
|
||||
Currently only Personal devices with Work Profile enrolled are supported for deployment.
|
||||
**Currently, Personally-owned devices with work profile and Corporate-owned fully managed user device enrollments are supported for deployment.**
|
||||
|
||||
|
||||
|
||||
@ -244,6 +243,45 @@ the *Required* section \> **Add group,** selecting the user group and click
|
||||
above. Then select **Review + Save** and then **Save** again to commence
|
||||
assignment.
|
||||
|
||||
### Auto Setup of Always-on VPN
|
||||
Defender for Endpoint supports Device configuration policies for managed devices via Intune. This capability can be leveraged to **Auto setup of Always-on VPN** on Android Enterprise enrolled devices, so the end user does not need to setup VPN service while onboarding.
|
||||
1. On **Devices** Page go to **Configuration Profiles** > **Create Profile** > **Platform** > **Android Enterprise**
|
||||
Select **Device restrictions** under one of the following, based on your device enrollment type
|
||||
- **Fully Managed, Dedicated, and Corporate-Owned Work Profile**
|
||||
- **Personally-Owned Work Profile**
|
||||
|
||||
Select **Create**.
|
||||
|
||||
> 
|
||||
|
||||
2. **Configuration Settings**
|
||||
Provide a **Name** and a **Description** to uniquely identify the configuration profile.
|
||||
|
||||
> 
|
||||
|
||||
3. Select **Connectivity** and configure VPN:
|
||||
- Enable **Always-on VPN**
|
||||
Setup a VPN client in the work profile to automatically connect and reconnect to the VPN whenever possible. Only one VPN client can be configured for always-on VPN on a given device, so be sure to have no more than one always-on VPN policy deployed to a single device.
|
||||
- Select **Custom** in VPN client dropdown list
|
||||
Custom VPN in this case is Defender for Endpoint VPN which is used to provide the Web Protection feature.
|
||||
> [!NOTE]
|
||||
> Microsoft Defender ATP app must be installed on user’s device, in order to functioning of auto setup of this VPN.
|
||||
|
||||
- Enter **Package ID** of the Microsoft Defender ATP app in Google Play store. For the Defender app URL https://play.google.com/store/apps/details?id=com.microsoft.scmx, Package ID is **com.microsoft.scmx**
|
||||
- **Lockdown mode** Not configured (Default)
|
||||
|
||||
|
||||
|
||||
4. **Assignment**
|
||||
In the **Assignments** page, select the user group to which this app config policy would be assigned to. Click **Select groups** to include and selecting the applicable group and then click **Next**. The group selected here is usually the same group to which you would assign Microsoft Defender for Endpoint Android app.
|
||||
|
||||
|
||||
|
||||
5. In the **Review + Create** page that comes up next, review all the information and then select **Create**.
|
||||
The device configuration profile is now assigned to the selected user group.
|
||||
|
||||
|
||||
|
||||
## Complete onboarding and check status
|
||||
|
||||
1. Confirm the installation status of Microsoft Defender for Endpoint for Android by
|
||||
@ -254,8 +292,7 @@ displayed here.
|
||||
> 
|
||||
|
||||
|
||||
2. On the device, you can confirm the same by going to the **work profile** and
|
||||
confirm that Defender for Endpoint is available.
|
||||
2. On the device, you can validate the onboarding status by going to the **work profile**. Confirm that Defender for Endpoint is available and that you are enrolled to the **Personally-owned devices with work profile**. If you are enrolled to a **Corporate-owned, fully managed user device**, you will have a single profile on the device where you can confirm that Defender for Endpoint is available.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -55,9 +55,9 @@ DO NOT USE THE APPLICATION.**
|
||||
of this application on Android enabled device or devices that you own
|
||||
or control. You may use this application with your company's valid
|
||||
subscription of Microsoft Defender for Endpoint or
|
||||
an online service that includes MDATP functionalities.
|
||||
an online service that includes Microsoft Defender for Endpoint functionalities.
|
||||
|
||||
2. **Updates.** Updates or upgrades to MDATP may be required for full
|
||||
2. **Updates.** Updates or upgrades to Microsoft Defender for Endpoint may be required for full
|
||||
functionality. Some functionality may not be available in all countries.
|
||||
|
||||
3. **Third-Party Programs.** The application may include third-party
|
||||
|
||||
@ -11,7 +11,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.date: 10/21/2020
|
||||
ms.date: 12/07/2020
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -32,34 +32,32 @@ ms.custom: AIR
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
|
||||
Your security operations team receives an alert whenever a malicious or suspicious artifact is detected by Microsoft Defender for Endpoint. Security operations teams face challenges in addressing the multitude of alerts that arise from the seemingly never-ending flow of threats. Microsoft Defender for Endpoint includes automated investigation and remediation capabilities that can help your security operations team address threats more efficiently and effectively.
|
||||
|
||||
Watch the following video to see how automated investigation and remediation works:
|
||||
Your security operations team receives an alert whenever a malicious or suspicious artifact is detected by Microsoft Defender for Endpoint. Security operations teams face challenges in addressing the multitude of alerts that arise from the seemingly never-ending flow of threats. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can help your security operations team address threats more efficiently and effectively. Want to see how it works? Watch the following video:
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4bOeh]
|
||||
|
||||
Automated investigation uses various inspection algorithms and processes used by analysts to examine alerts and take immediate action to resolve breaches. These capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. The [Action center](auto-investigation-action-center.md) keeps track of all the investigations that were initiated automatically, along with details, such as investigation status, detection source, and any pending or completed actions.
|
||||
The technology in automated investigation uses various inspection algorithms and is based on processes that are used by security analysts. AIR capabilities are designed to examine alerts and take immediate action to resolve breaches. AIR capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. The [Action center](auto-investigation-action-center.md) keeps track of all the investigations that were initiated automatically, along with details, such as investigation status, detection source, and any pending or completed actions.
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink).
|
||||
|
||||
## How the automated investigation starts
|
||||
|
||||
When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a device. When that file is detected, an alert is triggered, and the automated investigation process begins. Microsoft Defender for Endpoint checks to see if the malicious file is present on any other devices in the organization. Details from the investigation, including verdicts (*Malicious*, *Suspicious*, and *No threats found*) are available during and after the automated investigation.
|
||||
When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a device. When that file is detected, an alert is triggered, and the automated investigation process begins. Microsoft Defender for Endpoint checks to see if the malicious file is present on any other devices in the organization. Details from the investigation, including verdicts (*Malicious*, *Suspicious*, and *No threats found*) are available during and after the automated investigation. To learn more about what happens after a verdict is reached, see [Automated investigation results and remediation actions](manage-auto-investigation.md#automated-investigation-results-and-remediation-actions).
|
||||
|
||||
>[!NOTE]
|
||||
>Currently, automated investigation only supports the following OS versions:
|
||||
>Currently, AIR only supports the following OS versions:
|
||||
>- Windows Server 2019
|
||||
>- Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later
|
||||
>- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464/windows-10-update-kb4493464)) or later
|
||||
>- Later versions of Windows 10
|
||||
>- Windows 10, version [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later
|
||||
|
||||
## Details of an automated investigation
|
||||
|
||||
During and after an automated investigation, you can view details about the investigation. Select a triggering alert to view the investigation details. From there, you can go to the **Investigation graph**, **Alerts**, **Devices**, **Evidence**, **Entities**, and **Log** tabs.
|
||||
|
||||
|Tab |Description |
|
||||
|--|--|
|
||||
|:--|:--|
|
||||
|**Alerts**| The alert(s) that started the investigation.|
|
||||
|**Devices** |The device(s) where the threat was seen.|
|
||||
|**Evidence** |The entities that were found to be malicious during an investigation.|
|
||||
@ -82,20 +80,18 @@ As alerts are triggered, and an automated investigation runs, a verdict is gener
|
||||
|
||||
As verdicts are reached, automated investigations can result in one or more remediation actions. Examples of remediation actions include sending a file to quarantine, stopping a service, removing a scheduled task, and more. (See [Remediation actions](manage-auto-investigation.md#remediation-actions).)
|
||||
|
||||
Depending on the [level of automation](automation-levels.md) set for your organization, remediation actions can occur automatically or only upon approval by your security operations team.
|
||||
Depending on the [level of automation](automation-levels.md) set for your organization, as well as other security settings, remediation actions can occur automatically or only upon approval by your security operations team. Additional security settings that can affect automatic remediation include [protection from potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (PUA).
|
||||
|
||||
All remediation actions, whether pending or completed, can be viewed in Action Center. If necessary, your security operations team can undo a remediation action. (See [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).)
|
||||
All remediation actions, whether pending or completed, can be viewed in the [Action Center](auto-investigation-action-center.md) ([https://securitycenter.windows.com](https://securitycenter.windows.com)). If necessary, your security operations team can undo a remediation action. (See [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).)
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Get an overview of the automated investigations dashboard](manage-auto-investigation.md)
|
||||
|
||||
- [Learn more about automation levels](automation-levels.md)
|
||||
|
||||
- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide)
|
||||
|
||||
## See also
|
||||
|
||||
- [PUA protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)
|
||||
- [Automated investigation and response in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air)
|
||||
|
||||
- [Automated investigation and response in Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir)
|
||||
|
||||
@ -46,6 +46,7 @@ DisallowedOperation | Forbidden (403) | {the disallowed operation and the reason
|
||||
NotFound | Not Found (404) | General Not Found error message.
|
||||
ResourceNotFound | Not Found (404) | Resource {the requested resource} was not found.
|
||||
InternalServerError | Internal Server Error (500) | (No error message, try retry the operation or contact us if it does not resolved)
|
||||
TooManyRequests | Too Many Requests (429) | Response will represent reaching quota limit either by number of requests or by CPU.
|
||||
|
||||
## Body parameters are case-sensitive
|
||||
|
||||
|
||||
@ -109,6 +109,35 @@ After following the procedure, you have created a custom view that shows events
|
||||
|
||||
- [Evaluate controlled folder access](evaluate-controlled-folder-access.md). Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created.
|
||||
|
||||
- [Enable controlled folder access](enable-controlled-folders.md). Use Group Policy, PowerShell, or mobile device management CSPs to enable and manage controlled folder access in your network
|
||||
|
||||
- [Customize controlled folder access](customize-controlled-folders.md). Add additional protected folders, and allow specified apps to access protected folders.
|
||||
## Default folders protected by controlled folder access
|
||||
Windows system folders are protected by default. In addition, there are several folders that are protected by controlled folder access by default. You can configure additional folders as protected, but cannot remove the default folders from the controlled folder access protection. See [Protect additional folders](customize-controlled-folders.md#protect-additional-folders) for more information.
|
||||
|
||||
Here's the list of default protected folders:
|
||||
- %USERPROFILE%\Documents
|
||||
- %USERPROFILE%\Favorites
|
||||
- %USERPROFILE%\Music
|
||||
- %USERPROFILE%\Pictures
|
||||
- %USERPROFILE%\Videos
|
||||
- %PUBLIC%\Documents
|
||||
- %PUBLIC%\Music
|
||||
- %PUBLIC%\Pictures
|
||||
- %PUBLIC%\Videos
|
||||
|
||||
You can use the Windows Security app to view the list of default folders protected by controlled folder access:
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then scroll down to the **Ransomware protection** section.
|
||||
|
||||
3. Click the **Manage ransomware protection** link to open the **Ransomware protection** pane.
|
||||
|
||||
4. Under the **Controlled folder access** section, click the **Protected folders** link.
|
||||
|
||||
5. Click **Yes** on the **User Access Control** prompt.
|
||||
|
||||
The **Protected folders** pane displays the folders that are protected by default.
|
||||
|
||||
## In this section
|
||||
|
||||
[Customize controlled folder access](customize-controlled-folders.md). Add additional protected folders, and allow specified apps to access protected folders.
|
||||
|
||||
@ -37,7 +37,11 @@ This article describes how to customize the following settings of the controlled
|
||||
|
||||
## Protect additional folders
|
||||
|
||||
Controlled folder access applies to a number of system folders and default locations, such as Documents, Pictures, Movies, and Desktop. You can add additional folders to be protected, but you can't remove the default folders in the default list.
|
||||
|
||||
Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, and Movies.
|
||||
|
||||
You can add additional folders to be protected, but you cannot remove the default folders in the default list.
|
||||
|
||||
|
||||
Adding other folders to controlled folder access can be useful. Some use-cases include if you don't store files in the default Windows libraries, or you've changed the location of the libraries away from the defaults.
|
||||
|
||||
@ -49,11 +53,17 @@ You can use the Windows Security app or Group Policy to add and remove additiona
|
||||
|
||||
1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then select **Ransomware protection**.
|
||||
|
||||
3. Under the **Controlled folder access** section, select **Protected folders**.
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then scroll down to the **Ransomware protection** section.
|
||||
|
||||
3. Click the **Manage ransomware protection** link to open the **Ransomware protection** pane.
|
||||
|
||||
4. Under the **Controlled folder access** section, click the **Protected folders** link.
|
||||
|
||||
5. Click **Yes** on the **User Access Control** prompt. The **Protected folders** pane displays.
|
||||
|
||||
4. Click **Add a protected folder** and follow the prompts to add folders.
|
||||
|
||||
4. Select **Add a protected folder** and follow the prompts to add apps.
|
||||
|
||||
### Use Group Policy to protect additional folders
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -46,44 +46,44 @@ The **Use default** configuration for each of the mitigation settings indicates
|
||||
|
||||
For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this article.
|
||||
|
||||
Mitigation | Description | Can be applied to | Audit mode available
|
||||
-|-|-|-
|
||||
Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)]
|
||||
Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)]
|
||||
| Mitigation | Description | Can be applied to | Audit mode available |
|
||||
| ---------- | ----------- | ----------------- | -------------------- |
|
||||
| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] |
|
||||
| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work:
|
||||
>
|
||||
>
|
||||
> Enabled in **Program settings** | Enabled in **System settings** | Behavior
|
||||
> -|-|-
|
||||
> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings**
|
||||
> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings**
|
||||
> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings**
|
||||
> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option
|
||||
> | Enabled in **Program settings** | Enabled in **System settings** | Behavior |
|
||||
> | ------------------------------- | ------------------------------ | -------- |
|
||||
> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** |
|
||||
> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** |
|
||||
> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** |
|
||||
> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option |
|
||||
>
|
||||
>
|
||||
>
|
||||
> * **Example 1**
|
||||
> * **Example 1**
|
||||
>
|
||||
> Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**.
|
||||
>
|
||||
@ -116,10 +116,10 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir
|
||||
* **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section
|
||||
* **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation
|
||||
|
||||
>[!NOTE]
|
||||
>You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting.
|
||||
> [!NOTE]
|
||||
> You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting.
|
||||
|
||||
Changing some settings may require a restart.
|
||||
Changing some settings may require a restart.
|
||||
|
||||
4. Repeat this for all the system-level mitigations you want to configure.
|
||||
|
||||
@ -127,8 +127,8 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir
|
||||
|
||||
1. If the app you want to configure is already listed, select it and then select **Edit**
|
||||
2. If the app isn't listed, at the top of the list select **Add program to customize** and then choose how you want to add the app:
|
||||
* Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
* Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
* Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
* Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, select the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
@ -140,14 +140,14 @@ Exporting the configuration as an XML file allows you to copy the configuration
|
||||
|
||||
## PowerShell reference
|
||||
|
||||
You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets.
|
||||
You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets.
|
||||
|
||||
The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply.
|
||||
The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden.
|
||||
> [!IMPORTANT]
|
||||
> Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden.
|
||||
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app:
|
||||
|
||||
```PowerShell
|
||||
Get-ProcessMitigation -Name processName.exe
|
||||
@ -164,7 +164,7 @@ Get-ProcessMitigation -Name processName.exe
|
||||
|
||||
Use `Set` to configure each mitigation in the following format:
|
||||
|
||||
```PowerShell
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -<scope> <app executable> -<action> <mitigation or options>,<mitigation or options>,<mitigation or options>
|
||||
```
|
||||
|
||||
@ -179,34 +179,34 @@ Where:
|
||||
* \<Mitigation>:
|
||||
* The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma.
|
||||
|
||||
For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command:
|
||||
For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation
|
||||
```
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation
|
||||
```
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Separate each mitigation option with commas.
|
||||
> [!IMPORTANT]
|
||||
> Separate each mitigation option with commas.
|
||||
|
||||
If you wanted to apply DEP at the system level, you'd use the following command:
|
||||
If you wanted to apply DEP at the system level, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
Set-Processmitigation -System -Enable DEP
|
||||
```
|
||||
```PowerShell
|
||||
Set-Processmitigation -System -Enable DEP
|
||||
```
|
||||
|
||||
To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app.
|
||||
To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app.
|
||||
|
||||
If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example:
|
||||
If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example:
|
||||
|
||||
```PowerShell
|
||||
Set-Processmitigation -Name test.exe -Remove -Disable DEP
|
||||
```
|
||||
```PowerShell
|
||||
Set-Processmitigation -Name test.exe -Remove -Disable DEP
|
||||
```
|
||||
|
||||
You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below.
|
||||
You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below.
|
||||
|
||||
For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command:
|
||||
For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command:
|
||||
|
||||
```PowerShell
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode
|
||||
```
|
||||
|
||||
@ -218,29 +218,29 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that
|
||||
|
||||
<a id="cmdlets-table"></a>
|
||||
|
||||
Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet
|
||||
- | - | - | -
|
||||
Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available
|
||||
Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available
|
||||
Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available
|
||||
Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available
|
||||
Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available
|
||||
Validate heap integrity | System and app-level | TerminateOnError | Audit not available
|
||||
Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode
|
||||
Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad
|
||||
Block remote images | App-level only | BlockRemoteImages | Audit not available
|
||||
Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly
|
||||
Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned
|
||||
Disable extension points | App-level only | ExtensionPoint | Audit not available
|
||||
Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall
|
||||
Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess
|
||||
Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available
|
||||
Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available
|
||||
Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available
|
||||
Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available
|
||||
Validate handle usage | App-level only | StrictHandle | Audit not available
|
||||
Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available
|
||||
Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available
|
||||
| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet |
|
||||
| ---------- | ---------- | ------------------ | ----------------- |
|
||||
| Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available |
|
||||
| Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available |
|
||||
| Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available |
|
||||
| Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available |
|
||||
| Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available |
|
||||
| Validate heap integrity | System and app-level | TerminateOnError | Audit not available |
|
||||
| Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode |
|
||||
| Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad |
|
||||
| Block remote images | App-level only | BlockRemoteImages | Audit not available |
|
||||
| Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly |
|
||||
| Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned |
|
||||
| Disable extension points | App-level only | ExtensionPoint | Audit not available |
|
||||
| Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall |
|
||||
| Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess |
|
||||
| Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
| Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
| Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
| Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
| Validate handle usage | App-level only | StrictHandle | Audit not available |
|
||||
| Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available |
|
||||
| Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|
||||
<a href="#t1" id="r1">\[1\]</a>: Use the following format to enable EAF modules for dlls for a process:
|
||||
|
||||
@ -248,11 +248,13 @@ Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot
|
||||
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll
|
||||
```
|
||||
|
||||
<a href="#t2" id="r2">\[2\]</a>: Audit for this mitigation is not available via PowerShell cmdlets.
|
||||
|
||||
## Customize the notification
|
||||
|
||||
For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center).
|
||||
|
||||
## See also
|
||||
## See also:
|
||||
|
||||
* [Protect devices from exploits](exploit-protection.md)
|
||||
* [Evaluate exploit protection](evaluate-exploit-protection.md)
|
||||
|
||||
@ -27,46 +27,50 @@ ms.topic: article
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
|
||||
|
||||
Microsoft Defender for Endpoint has the capabilities to effectively protect your enterprise from cyber threats.
|
||||
|
||||
Learn how to deploy Microsoft Defender for Endpoint so that your enterprise can take advantage of preventative protection, post-breach detection, automated investigation, and response.
|
||||
|
||||
|
||||
This solution provides guidance on the three phases of deployment. Each section corresponds to a separate article in this solution.
|
||||
This guide helps you work across stakeholders to prepare your environment and then onboard devices in a methodical way, moving from evaluation, to a meaningful pilot, to full deployment.
|
||||
|
||||
Each section corresponds to a separate article in this solution.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Phase | Description |
|
||||
|:-------|:-----|
|
||||
| [Phase 1: Prepare](prepare-deployment.md)| Learn about what you need to consider when deploying Defender for Endpoint such as stakeholder approvals, environment considerations, access permissions, and adoption order of capabilities.
|
||||
| [Phase 2: Setup](production-deployment.md)| Get guidance on the initial steps you need to take so that you can access the portal such as validating licensing, completing the setup wizard, and network configuration.
|
||||
| [Phase 3: Onboard](onboarding.md) | Learn how to make use of deployment rings, supported onboarding tools based on the type of endpoint, and configuring available capabilities.
|
||||
|
||||
|
||||
After you've completed this guide, you'll be setup with the right access permissions, your endpoints will be onboarded and reporting sensor data to the service, and capabilities such as next-generation protection and attack surface reduction will be in place.
|
||||
|
||||
|
||||
|
||||
|
||||
Regardless of the environment architecture and method of deployment you choose outlined in the [Plan deployment](deployment-strategy.md) guidance, this guide is going to support you in onboarding endpoints.
|
||||
|
||||
|
||||
## Prepare
|
||||
Learn about what you need to consider when deploying Defender for Endpoint such as stakeholder approvals, environment considerations, access permissions, and adoption order of capabilities.
|
||||
|
||||
## Setup
|
||||
Get guidance on the initial steps you need to take so that you can access the portal such as validating licensing, completing the setup wizard, and network configuration.
|
||||
|
||||
## Onboard
|
||||
Learn how to make use of deployment rings, supported onboarding tools based on the type of endpoint, and configuring available capabilities.
|
||||
|
||||
|
||||
|
||||
|
||||
## Key capabilities
|
||||
|
||||
This solution provides the following key capabilities:
|
||||
While Microsoft Defender for Endpoint provides many capabilities, the primary purpose of this deployment guide is to get you started by onboarding devices. In addition to onboarding, this guidance gets you started with the following capabilities.
|
||||
|
||||
|
||||
|
||||
Capability | Description
|
||||
:---|:---
|
||||
Eliminate risks and reduce your attack surface| Use attack surface reduction to minimize the areas where your organization could be vulnerable to threats.
|
||||
Block sophisticated threats and malware | Defend against never-before-seen polymorphic and metamorphic malware and fileless and file-based threats with next-generation protection.
|
||||
Remediation at scale with automation | Automatically investigate alerts and remediate complex threats in minutes. Apply best practices and intelligent decision-making algorithms to determine whether a threat is active and what action to take.
|
||||
Discover vulnerabilities and misconfigurations in real time | Bring security and IT together with Microsoft Threat & Vulnerability Management to quickly discover, prioritize, and remediate vulnerabilities and misconfigurations.
|
||||
Get expert-level threat monitoring and analysis | Empower your security operations centers with Microsoft Threat Experts. Get deep knowledge, advanced threat monitoring, analysis, and support to identify critical threats in your unique environment.
|
||||
Detect and respond to advanced attacks with behavioral monitoring | Spot attacks and zero-day exploits using advanced behavioral analytics and machine learning.
|
||||
Cross-platform support | Microsoft Defender for Endpoint provides security for non-Windows platforms including Mac, Linux servers, and Android.
|
||||
Evaluate capabilities | Fully evaluate our capabilities with a few simple clicks in the Microsoft Defender for Endpoint evaluation lab.
|
||||
Streamline and integrate via APIs | Integrate Microsoft Defender for Endpoint with your security solutions and streamline and automate security workflows with rich APIs.
|
||||
Simplify endpoint security management | Use a single pane of glass for all endpoint security actions, such as endpoint configuration, deployment, and management with Microsoft Endpoint Manager.
|
||||
Endpoint detection and response | Endpoint detection and response capabilities are put in place to detect, investigate, and respond to intrusion attempts and active breaches.
|
||||
Next-generation protection | To further reinforce the security perimeter of your network, Microsoft Defender for Endpoint uses next-generation protection designed to catch all types of emerging threats.
|
||||
Attack surface reduction | Provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation.
|
||||
|
||||
All these capabilities are available for Microsoft Defender for Endpoint license holders. For more information, see [Licensing requirements](minimum-requirements.md#licensing-requirements).
|
||||
|
||||
## Scope
|
||||
|
||||
|
||||
@ -32,7 +32,7 @@ Plan your Microsoft Defender for Endpoint deployment so that you can maximize th
|
||||
This solution provides guidance on how to identify your environment architecture, select the type of deployment tool that best fits your needs, and guidance on how to configure capabilities.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Step 1: Identify architecture
|
||||
|
||||
Binary file not shown.
Binary file not shown.
@ -15,7 +15,7 @@ ms.localizationpriority: medium
|
||||
ms.custom:
|
||||
- next-gen
|
||||
- edr
|
||||
ms.date: 08/21/2020
|
||||
ms.date: 12/10/2020
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
@ -39,7 +39,7 @@ EDR in block mode is also integrated with [threat & vulnerability management](ht
|
||||
:::image type="content" source="images/edrblockmode-TVMrecommendation.png" alt-text="recommendation to turn on EDR in block mode":::
|
||||
|
||||
> [!NOTE]
|
||||
> EDR in block mode is currently in preview, available to organizations who have opted in to receive **[preview features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview)**. To get the best protection, make sure to **[deploy Microsoft Defender for Endpoint baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||
> To get the best protection, make sure to **[deploy Microsoft Defender for Endpoint baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
@ -81,6 +81,10 @@ The following image shows an instance of unwanted software that was detected and
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices?
|
||||
|
||||
We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Microsoft Defender for Endpoint to take actions based on post-breach behavioral EDR detections.
|
||||
|
||||
### Will EDR in block mode have any impact on a user's antivirus protection?
|
||||
|
||||
No. EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode kicks in if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected.
|
||||
|
||||
@ -226,7 +226,7 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that
|
||||
|Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall
|
||||
|Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess
|
||||
|Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
||Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Validate handle usage | App-level only | StrictHandle | Audit not available |
|
||||
|
||||
@ -36,7 +36,7 @@ Retrieves specific [Alert](alerts.md) by its ID.
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -36,7 +36,7 @@ Retrieves a collection of [Machines](machine.md) that have communicated to or fr
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -27,7 +27,7 @@ ms.topic: article
|
||||
Retrieves a security recommendation by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) for details.
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md) for details.
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Become a Microsoft Defender ATP partner
|
||||
title: Become a Microsoft Defender for Endpoint partner
|
||||
ms.reviewer:
|
||||
description: Learn the steps and requirements to integrate your solution with Microsoft Defender ATP and be a partner
|
||||
keywords: partner, integration, solution validation, certification, requirements, member, misa, application portal
|
||||
@ -40,17 +40,23 @@ Once the Microsoft Defender for Endpoint team has reviewed and approves the inte
|
||||
[Microsoft Intelligent Security Association](https://www.microsoft.com/security/partnerships/intelligent-security-association) is a program specifically for Microsoft security partners to help enrich your security products and improve customer discoverability of your integrations to Microsoft security products.
|
||||
|
||||
## Step 4: Get listed in the Microsoft Defender for Endpoint partner application portal
|
||||
Microsoft Defender ATP supports third-party applications discovery and integration using the in-product [partner page](partner-applications.md) that is embedded within the Microsoft Defender for Endpoint management portal.
|
||||
Microsoft Defender for Endpoint supports third-party applications discovery and integration using the in-product [partner page](partner-applications.md) that is embedded within the Microsoft Defender for Endpoint management portal.
|
||||
|
||||
To have your company listed as a partner in the in-product partner page, you will need to provide the following information:
|
||||
|
||||
1. A square logo (SVG).
|
||||
2. Name of the product to be presented.
|
||||
3. Provide a 15-word product description.
|
||||
4. Link to the landing page for the customer to complete the integration or blog post that will include sufficient information for customers. Any press release including the Microsoft Defender ATP product name should be reviewed by the marketing and engineering teams. Wait for at least 10 days for the review process to be done.
|
||||
4. Link to the landing page for the customer to complete the integration or blog post that will include sufficient information for customers. Any press release including the Microsoft Defender for Endpoint product name should be reviewed by the marketing and engineering teams. Wait for at least 10 days for the review process to be done.
|
||||
5. If you use a multi-tenant Azure AD approach, we will need the Azure AD application name to track usage of the application.
|
||||
6. Include the User-Agent field in each API call made to Microsoft Defender for Endpoint public set of APIs or Graph Security APIs. This will be used for statistical purposes, troubleshooting, and partner recognition. In addition, this step is a requirement for membership in Microsoft Intelligent Security Association (MISA).
|
||||
|
||||
Follow these steps:
|
||||
1. Identify a name adhering to the following nomenclature that includes your company name and the Microsoft Defender for Endpoint-integrated product with the version of the product that includes this integration.
|
||||
- ISV Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{Version}`
|
||||
- Security partner Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{TenantID}`
|
||||
|
||||
|
||||
- Set the User-Agent field in each HTTP request header to the name based on the Following nomenclature.
|
||||
|
||||
- `MsdePartner-{CompanyName}-{ProductName}/{Version}`
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 75 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 38 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 151 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 96 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 87 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 87 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 138 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 126 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 96 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 63 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 115 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 106 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
@ -36,6 +36,9 @@ The threat intelligence data set for this has been managed by Microsoft.
|
||||
|
||||
By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others.
|
||||
|
||||
> [!NOTE]
|
||||
> Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported.
|
||||
|
||||
### Before you begin
|
||||
It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains:
|
||||
- URL/IP allow and block relies on the Defender for Endpoint component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md).
|
||||
|
||||
@ -68,7 +68,7 @@ rbacGroupNames | String | Comma-separated list of RBAC group names the indicator
|
||||
category | String | Category of the alert. Examples include: Execution and credential access. **Optional**
|
||||
mitretechniques| String | MITRE techniques code/id (comma separated). For more information, see [Enterprise tactics](https://attack.mitre.org/tactics/enterprise/). **Optional** It is recommended to add a value in category when a MITRE technique.
|
||||
|
||||
For more information, see [Microsoft Defender ATP alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748).
|
||||
For more information, see [Microsoft Defender for Endpoint alert categories are now aligned with MITRE ATT&CK!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748).
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
@ -143,7 +143,7 @@ To further inspect the event and related events, you can quickly run an [advance
|
||||
|
||||
### Security recommendations
|
||||
|
||||
**Security recommendations** are generated from Microsoft Defender ATP's [Threat & Vulnerability Management](tvm-dashboard-insights.md) capability. Selecting a recommendation will show a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. See [Security recommendation](tvm-security-recommendation.md) for details.
|
||||
**Security recommendations** are generated from Microsoft Defender for Endpoint's [Threat & Vulnerability Management](tvm-dashboard-insights.md) capability. Selecting a recommendation will show a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. See [Security recommendation](tvm-security-recommendation.md) for details.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -27,38 +27,30 @@ ms.topic: conceptual
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint for iOS would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> **PUBLIC PREVIEW EDITION**
|
||||
>
|
||||
> This documentation is for a pre-release solution. The guidelines and the solution are subject to change between now and its general availability.
|
||||
>
|
||||
> As with any pre-release solution, remember to exercise caution when determining the target population for your deployments.
|
||||
|
||||
|
||||
## Configure compliance policy against jailbroken devices
|
||||
|
||||
To protect corporate data from being accessed on jailbroken iOS devices, we recommend that you set up the following compliance policy on Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> Currently Defender for Endpoint for iOS does not provide protection against jailbreak scenarios. Some data like your corporate email id and corporate profile picture (if available) will be exposed to the attacker on the jailbroken device.
|
||||
> At this time Microsoft Defender for Endpoint for iOS does not provide protection against jailbreak scenarios. If used on a jailbroken device, then in specific scenarios data that is used by the application like your corporate email id and corporate profile picture (if available) can be exposed locally
|
||||
|
||||
Follow the steps below to create a compliance policy against jailbroken devices.
|
||||
|
||||
1. In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** -> **Compliance policies** -> click on **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
1. Specify a name of the policy, example "Compliance Policy for Jailbreak".
|
||||
1. In the compliance settings page, click to expand **Device Health** section and click **Block** for **Jailbroken devices** field.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
1. In the *Action for noncompliance* section, select the actions as per your requirements and click **Next**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
> 
|
||||
|
||||
1. In the *Assignments* section, select the user groups that you want to include for this policy and then click **Next**.
|
||||
1. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**.
|
||||
@ -70,6 +62,26 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint for iOS supports creating custom indicators only for IP addresses and URLs/domains.
|
||||
|
||||
## Web Protection
|
||||
## Web Protection and VPN
|
||||
|
||||
By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks.
|
||||
By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a VPN in order to provide this protection. Please note this is a local VPN and unlike traditional VPN, network traffic is not sent outside the device.
|
||||
|
||||
While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below:
|
||||
|
||||
1. On your iOS device, open the **Settings** app, click or tap **General** and then **VPN**.
|
||||
1. Click or tap the "i" button for Microsoft Defender ATP.
|
||||
1. Toggle off **Connect On Demand** to disable VPN.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
> [!NOTE]
|
||||
> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open the Microsoft Defender for Endpoint app on the device and click or tap **Start VPN**.
|
||||
|
||||
### Co-existence of multiple VPN profiles
|
||||
|
||||
Apple iOS does not support multiple device-wide VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time.
|
||||
|
||||
## Report unsafe site
|
||||
|
||||
Phishing websites impersonate trustworthy websites for the purpose of obtaining your personal or financial information. Visit the [Provide feedback about network protection](https://www.microsoft.com/wdsi/filesubmission/exploitguard/networkprotection) page if you want to report a website that could be a phishing site.
|
||||
|
||||
@ -20,62 +20,118 @@ ms.collection:
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# App-based deployment for Microsoft Defender for Endpoint for iOS
|
||||
# Deploy Microsoft Defender for Endpoint for iOS
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
> [!IMPORTANT]
|
||||
> **PUBLIC PREVIEW EDITION**
|
||||
>
|
||||
> This documentation is for a pre-release solution. The guidelines and the solution are subject to change between now and its general availability.
|
||||
>
|
||||
> As with any pre-release solution, remember to exercise caution when determining the target population for your deployments.
|
||||
|
||||
Defender for Endpoint for iOS is currently available as a preview app on TestFlight, Apple's beta testing platform. In GA, it will be available on the Apple App store.
|
||||
|
||||
Deployment devices need to be enrolled on Intune Company portal. Refer to
|
||||
[Enroll your
|
||||
device](https://docs.microsoft.com/mem/intune/enrollment/ios-enroll) to
|
||||
learn more about Intune device enrollment
|
||||
This topic describes deploying Defender for Endpoint for iOS on Intune Company Portal enrolled devices. For more information about Intune device enrollment, see [Enroll iOS/iPadOS devices in Intune](https://docs.microsoft.com/mem/intune/enrollment/ios-enroll).
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Ensure you have access to [Microsoft Endpoint manager admin
|
||||
center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
- Ensure you have access to [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
|
||||
- Ensure iOS enrollment is done for your users. Users need to have Defender for Endpoint
|
||||
license assigned in order to use Defender for Endpoint for iOS. Refer [Assign licenses to
|
||||
users](https://docs.microsoft.com/azure/active-directory/users-groups-roles/licensing-groups-assign)
|
||||
for instructions on how to assign licenses.
|
||||
- Ensure iOS enrollment is done for your users. Users need to have a Defender for Endpoint license assigned in order to use Defender for Endpoint for iOS. Refer to [Assign licenses to users](https://docs.microsoft.com/azure/active-directory/users-groups-roles/licensing-groups-assign) for instructions on how to assign licenses.
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Defender ATP (Microsoft Defender for Endpoint) for iOS is now available in the [Apple App Store](https://aka.ms/mdatpiosappstore).
|
||||
|
||||
## Deployment steps
|
||||
|
||||
To install Defender for Endpoint for iOS, end-users can visit
|
||||
<https://aka.ms/defenderios> on their iOS devices. This link will open the
|
||||
TestFlight application on their device or prompt them to install TestFlight. On
|
||||
the TestFlight app, follow the onscreen instructions to install Defender for Endpoint.
|
||||
Deploy Defender for Endpoint for iOS via Intune Company Portal.
|
||||
|
||||
### Add iOS store app
|
||||
|
||||
|
||||
1. In [Microsoft Endpoint manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Apps** -> **iOS/iPadOS** -> **Add** -> **iOS store app** and click **Select**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
1. On the Add app page, click on **Search the App Store** and type **Microsoft Defender ATP** in the search bar. In the search results section, click on *Microsoft Defender ATP* and click **Select**.
|
||||
|
||||
1. Select **iOS 11.0** as the Minimum operating system. Review the rest of information about the app and click **Next**.
|
||||
|
||||
1. In the *Assignments* section, go to the **Required** section and select **Add group**. You can then choose the user group(s) that you would like to target Defender for Endpoint for iOS app. Click **Select** and then **Next**.
|
||||
|
||||
> [!NOTE]
|
||||
> The selected user group should consist of Intune enrolled users.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
1. In the *Review + Create* section, verify that all the information entered is correct and then select **Create**. In a few moments, the Defender for Endpoint app should be created successfully, and a notification should show up at the top-right corner of the page.
|
||||
|
||||
1. In the app information page that is displayed, in the **Monitor** section, select **Device install status** to verify that the device installation has completed successfully.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
## Complete onboarding and check status
|
||||
|
||||
1. Once Defender for Endpoint for iOS has been installed on the device, you
|
||||
1. Once Defender for Endpoint for iOS has been installed on the device, you
|
||||
will see the app icon.
|
||||
|
||||
|
||||
|
||||
2. Tap the Defender for Endpoint app icon and follow the on-screen
|
||||
instructions to complete the onboarding steps. The details include end-user
|
||||
acceptance of iOS permissions required by Defender for Endpoint for iOS.
|
||||
2. Tap the Defender for Endpoint app icon and follow the on-screen instructions to complete the onboarding steps. The details include end-user acceptance of iOS permissions required by Defender for Endpoint for iOS.
|
||||
|
||||
3. Upon successful onboarding, the device will start showing up on the Devices
|
||||
list in Microsoft Defender Security Center.
|
||||
3. Upon successful onboarding, the device will start showing up on the Devices list in Microsoft Defender Security Center.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
## Configure Microsoft Defender for Endpoint for Supervised Mode
|
||||
|
||||
The Microsoft Defender for Endpoint for iOS app has specialized ability on supervised iOS/iPadOS devices, given the increased management capabilities provided by the platform on these types of devices. To take advantage of these capabilities, the Defender for Endpoint app needs to know if a device is in Supervised Mode.
|
||||
|
||||
### Configure Supervised Mode via Intune
|
||||
|
||||
Intune allows you to configure the Defender for iOS app through an App Configuration policy.
|
||||
|
||||
> [!NOTE]
|
||||
> This app configuration policy for supervised devices is applicable only to managed devices and should be targeted for all managed iOS devices as a best practice.
|
||||
|
||||
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and go to **Apps** > **App configuration policies** > **Add**. Click on **Managed devices**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
1. In the *Create app configuration policy* page, provide the following information:
|
||||
- Policy Name
|
||||
- Platform: Select iOS/iPadOS
|
||||
- Targeted app: Select **Microsoft Defender ATP** from the list
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
1. In the next screen, select **Use configuration designer** as the format. Specify the following property:
|
||||
- Configuration Key: issupervised
|
||||
- Value type: String
|
||||
- Configuration Value: {{issupervised}}
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
1. Click **Next** to open the **Scope tags** page. Scope tags are optional. Click **Next** to continue.
|
||||
|
||||
1. On the **Assignments** page, select the groups that will receive this profile. For this scenario, it is best practice to target **All Devices**. For more information on assigning profiles, see [Assign user and device profiles](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).
|
||||
|
||||
When deploying to user groups, a user must sign in to a device before the policy applies.
|
||||
|
||||
Click **Next**.
|
||||
|
||||
1. On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles.
|
||||
|
||||
1. Next, for enhanced Anti-phishing capabilities, you can deploy a custom profile on the supervised iOS devices. Follow the steps below:
|
||||
- Download the config profile from [https://aka.ms/mdatpiossupervisedprofile](https://aka.ms/mdatpiossupervisedprofile)
|
||||
- Navigate to **Devices** -> **iOS/iPadOS** -> **Configuration profiles** -> **Create Profile**
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
|
||||
|
||||
- Provide a name of the profile. When prompted to import a Configuration profile file, select the one downloaded above.
|
||||
- In the **Assignment** section, select the device group to which you want to apply this profile. As a best practice, this should be applied to all managed iOS devices. Click **Next**.
|
||||
- On the **Review + create** page, when you're done, choose **Create**. The new profile is displayed in the list of configuration profiles.
|
||||
|
||||
## Next Steps
|
||||
|
||||
[Configure Defender for Endpoint for iOS features](ios-configure-features.md)
|
||||
|
||||
@ -38,7 +38,7 @@ This article describes how to deploy Microsoft Defender for Endpoint for Linux m
|
||||
|
||||
## Prerequisites and system requirements
|
||||
|
||||
Before you get started, see [Microsoft Defender ATP for Linux](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version.
|
||||
Before you get started, see [Microsoft Defender for Endpoint for Linux](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version.
|
||||
|
||||
## Configure the Linux software repository
|
||||
|
||||
|
||||
@ -98,7 +98,7 @@ The following fields are considered common for all events:
|
||||
|
||||
**Required diagnostic data** is the minimum data necessary to help keep Defender for Endpoint secure, up-to-date, and perform as expected on the device it’s installed on.
|
||||
|
||||
Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Defender for Endpoint feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Defender for Endpoint features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced.
|
||||
Required diagnostic data helps to identify problems with Microsoft Defender for Endpoint that may be related to a device or software configuration. For example, it can help determine if a Defender for Endpoint feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Defender for Endpoint features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced.
|
||||
|
||||
#### Software setup and inventory data events
|
||||
|
||||
|
||||
@ -55,7 +55,7 @@ Check if the mdatp service is running:
|
||||
systemctl status mdatp
|
||||
```
|
||||
```Output
|
||||
● mdatp.service - Microsoft Defender ATP
|
||||
● mdatp.service - Microsoft Defender for Endpoint
|
||||
Loaded: loaded (/lib/systemd/system/mdatp.service; enabled; vendor preset: enabled)
|
||||
Active: active (running) since Thu 2020-03-26 10:37:30 IST; 23h ago
|
||||
Main PID: 1966 (wdavdaemon)
|
||||
|
||||
@ -0,0 +1,182 @@
|
||||
---
|
||||
title: How to schedule an update of the Microsoft Defender for Endpoint (Linux)
|
||||
description: Learn how to schedule an update of the Microsoft Defender for Endpoint (Linux) to better protect your organization's assets.
|
||||
keywords: microsoft, defender, atp, linux, scans, antivirus, microsoft defender for endpoint (linux)
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Schedule an update of the Microsoft Defender for Endpoint (Linux)
|
||||
|
||||
To run an update on Microsoft Defender for Endpoint for Linux, see [Deploy updates for Microsoft Defender for Endpoint for Linux](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/linux-updates).
|
||||
|
||||
Linux (and Unix) have a tool called **crontab** (similar to Task Scheduler) to be able to run scheduled tasks.
|
||||
|
||||
## Pre-requisite
|
||||
|
||||
> [!NOTE]
|
||||
> To get a list of all the time zones, run the following command:
|
||||
> `timedatectl list-timezones`<br>
|
||||
> Examples for timezones: <br>
|
||||
> - `America/Los_Angeles`
|
||||
> - `America/New_York`
|
||||
> - `America/Chicago`
|
||||
> - `America/Denver`
|
||||
|
||||
## To set the Cron job
|
||||
Use the following commands:
|
||||
|
||||
**To backup crontab entries**
|
||||
|
||||
`sudo crontab -l > /var/tmp/cron_backup_201118.dat`
|
||||
|
||||
> [!NOTE]
|
||||
> Where 201118 == YYMMDD
|
||||
|
||||
> [!TIP]
|
||||
> Do this before you edit or remove. <br>
|
||||
|
||||
To edit the crontab, and add a new job as a root user: <br>
|
||||
`sudo crontab -e`
|
||||
|
||||
> [!NOTE]
|
||||
> The default editor is VIM.
|
||||
|
||||
You might see:
|
||||
|
||||
0****/etc/opt/microsoft/mdatp/logrorate.sh
|
||||
|
||||
And
|
||||
|
||||
02**sat /bin/mdatp scan quick>~/mdatp_cron_job.log
|
||||
|
||||
See [Schedule scans with Microsoft Defender for Endpoint (Linux)](linux-schedule-scan-atp.md)
|
||||
|
||||
Press “Insert”
|
||||
|
||||
Add the following entries:
|
||||
|
||||
CRON_TZ=America/Los_Angeles
|
||||
|
||||
> #!RHEL and variants (CentOS and Oracle Linux)
|
||||
|
||||
`06**sun[$(date +\%d) -le 15] sudo yum update mdatp>>~/mdatp_cron_job.log`
|
||||
|
||||
> #!SLES and variants
|
||||
|
||||
`06**sun[$(date +\%d) -le 15] sudo zypper update mdatp>>~/mdatp_cron_job.log`
|
||||
|
||||
> #!Ubuntu and Debian systems
|
||||
|
||||
`06**sun [$(date +\%d) -le 15] sudo apt-get install --only-upgrade mdatp>>~/mdatp_cron_job.log`
|
||||
|
||||
> [!NOTE]
|
||||
> In the examples above, we are setting it to 00 minutes, 6 a.m.(hour in 24 hour format), any day of the month, any month, on Sundays.[$(date +\%d) -le 15] == Won’t run unless it’s equal or less than the 15th day (3rd week). Meaning it will run every 3rd Sundays(7) of the month at 6:00 a.m. Pacific (UTC -8).
|
||||
|
||||
Press “Esc”
|
||||
|
||||
Type “:wq” w/o the double quotes.
|
||||
|
||||
> [!NOTE]
|
||||
> w == write, q == quit
|
||||
|
||||
To view your cron jobs, type `sudo crontab -l`
|
||||
|
||||
:::image type="content" source="images/update-MDE-linux-4634577.jpg" alt-text="update MDE linux":::
|
||||
|
||||
To inspect cron job runs:
|
||||
`sudo grep mdatp /var/log/cron`
|
||||
|
||||
To inspect the mdatp_cron_job.log
|
||||
`sudo nano mdatp_cron_job.log`
|
||||
|
||||
## For those who use Ansible, Chef, or Puppet
|
||||
|
||||
Use the following commands:
|
||||
### To set cron jobs in Ansible
|
||||
|
||||
`cron – Manage cron.d and crontab entries`
|
||||
|
||||
See [https://docs.ansible.com/ansible/latest/modules/cron_module.html](https://docs.ansible.com/ansible/latest/modules/cron_module.html) for more information.
|
||||
|
||||
### To set crontabs in Chef
|
||||
`cron resource`
|
||||
|
||||
See [https://docs.chef.io/resources/cron/](https://docs.chef.io/resources/cron/) for more information.
|
||||
|
||||
### To set cron jobs in Puppet
|
||||
Resource Type: cron
|
||||
|
||||
See [https://puppet.com/docs/puppet/5.5/types/cron.html](https://puppet.com/docs/puppet/5.5/types/cron.html) for more information.
|
||||
|
||||
Automating with Puppet: Cron jobs and scheduled tasks
|
||||
|
||||
See [https://puppet.com/blog/automating-puppet-cron-jobs-and-scheduled-tasks/](https://puppet.com/blog/automating-puppet-cron-jobs-and-scheduled-tasks/) for more information.
|
||||
|
||||
## Additional information
|
||||
|
||||
**To get help with crontab**
|
||||
|
||||
`man crontab`
|
||||
|
||||
**To get a list of crontab file of the current user**
|
||||
|
||||
`crontab -l`
|
||||
|
||||
**To get a list of crontab file of another user**
|
||||
|
||||
`crontab -u username -l`
|
||||
|
||||
**To backup crontab entries**
|
||||
|
||||
`crontab -l > /var/tmp/cron_backup.dat`
|
||||
|
||||
> [!TIP]
|
||||
> Do this before you edit or remove. <br>
|
||||
|
||||
**To restore crontab entries**
|
||||
|
||||
`crontab /var/tmp/cron_backup.dat`
|
||||
|
||||
**To edit the crontab and add a new job as a root user**
|
||||
|
||||
`sudo crontab -e`
|
||||
|
||||
**To edit the crontab and add a new job**
|
||||
|
||||
`crontab -e`
|
||||
|
||||
**To edit other user’s crontab entries**
|
||||
|
||||
`crontab -u username -e`
|
||||
|
||||
**To remove all crontab entries**
|
||||
|
||||
`crontab -r`
|
||||
|
||||
**To remove other user’s crontab entries**
|
||||
|
||||
`crontab -u username -r`
|
||||
|
||||
**Explanation**
|
||||
|
||||
<pre>
|
||||
+—————- minute (values: 0 – 59) (special characters: , – * /) <br>
|
||||
| +————- hour (values: 0 – 23) (special characters: , – * /) <br>
|
||||
| | +———- day of month (values: 1 – 31) (special characters: , – * / L W C) <br>
|
||||
| | | +——- month (values: 1 – 12) (special characters: ,- * / ) <br>
|
||||
| | | | +—- day of week (values: 0 – 6) (Sunday=0 or 7) (special characters: , – * / L W C) <br>
|
||||
| | | | |*****command to be executed
|
||||
</pre>
|
||||
|
||||
@ -30,6 +30,9 @@ ms.topic: conceptual
|
||||
|
||||
Learn how to deploy Microsoft Defender for Endpoint for macOS with Jamf Pro.
|
||||
|
||||
> [!NOTE]
|
||||
> If you are using macOS Catalina (10.15.4) or newer versions of macOS, see [New configuration profiles for macOS Catalina and newer versions of macOS](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies).
|
||||
|
||||
This is a multi step process. You'll need to complete all of the following steps:
|
||||
|
||||
- [Login to the Jamf Portal](mac-install-jamfpro-login.md)
|
||||
@ -40,4 +43,3 @@ This is a multi step process. You'll need to complete all of the following steps
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -112,4 +112,4 @@ As part of the Endpoint Detection and Response capabilities, Microsoft Defender
|
||||
|
||||
## Check installation status
|
||||
|
||||
Run [mdatp](mac-install-with-jamf.md) on a client device to check the onboarding status.
|
||||
Run [Microsoft Defender for Endpoint](mac-install-with-jamf.md) on a client device to check the onboarding status.
|
||||
|
||||
@ -46,13 +46,13 @@ If you can reproduce a problem, increase the logging level, run the system for s
|
||||
|
||||
3. Run `sudo mdatp diagnostic create` to back up the Microsoft Defender for Endpoint logs. The files will be stored inside a .zip archive. This command will also print out the file path to the backup after the operation succeeds.
|
||||
|
||||
> [!TIP]
|
||||
> By default, diagnostic logs are saved to `/Library/Application Support/Microsoft/Defender/wdavdiag/`. To change the directory where diagnostic logs are saved, pass `--path [directory]` to the below command, replacing `[directory]` with the desired directory.
|
||||
> [!TIP]
|
||||
> By default, diagnostic logs are saved to `/Library/Application Support/Microsoft/Defender/wdavdiag/`. To change the directory where diagnostic logs are saved, pass `--path [directory]` to the below command, replacing `[directory]` with the desired directory.
|
||||
|
||||
```bash
|
||||
sudo mdatp diagnostic create
|
||||
```
|
||||
```Output
|
||||
```console
|
||||
Diagnostic file created: "/Library/Application Support/Microsoft/Defender/wdavdiag/932e68a8-8f2e-4ad0-a7f2-65eb97c0de01.zip"
|
||||
```
|
||||
|
||||
@ -61,7 +61,7 @@ If you can reproduce a problem, increase the logging level, run the system for s
|
||||
```bash
|
||||
mdatp log level set --level info
|
||||
```
|
||||
```Output
|
||||
```console
|
||||
Log level configured successfully
|
||||
```
|
||||
|
||||
@ -102,10 +102,10 @@ Important tasks, such as controlling product settings and triggering on-demand s
|
||||
|Configuration|Turn on audit mode for PUA protection |`mdatp threat policy set --type potentially_unwanted_application -- action audit` |
|
||||
|Configuration|Turn on/off passiveMode |`mdatp config passive-mode --value enabled [enabled/disabled]` |
|
||||
|Diagnostics |Change the log level |`mdatp log level set --level [error/warning/info/verbose]` |
|
||||
|Diagnostics |Generate diagnostic logs |`mdatp diagnostic create --path [directory]` |
|
||||
|Diagnostics |Generate diagnostic logs |`mdatp diagnostic create --path [directory]` |
|
||||
|Health |Check the product's health |`mdatp health` |
|
||||
|Health |Check for a spefic product attribute |`mdatp health --field [attribute: healthy/licensed/engine_version...]` |
|
||||
|Protection |Scan a path |`mdatp scan custom --path [path]` |
|
||||
|Protection |Scan a path |`mdatp scan custom --path [path] [--ignore-exclusions]` |
|
||||
|Protection |Do a quick scan |`mdatp scan quick` |
|
||||
|Protection |Do a full scan |`mdatp scan full` |
|
||||
|Protection |Cancel an ongoing on-demand scan |`mdatp scan cancel` |
|
||||
@ -113,17 +113,17 @@ Important tasks, such as controlling product settings and triggering on-demand s
|
||||
|EDR |Turn on/off EDR preview for Mac |`mdatp edr early-preview [enabled/disabled]` |
|
||||
|EDR |Add group tag to device. EDR tags are used for managing device groups. For more information, please visit https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups |`mdatp edr tag set --name GROUP --value [name]` |
|
||||
|EDR |Remove group tag from device |`mdatp edr tag remove --tag-name [name]` |
|
||||
|EDR |Add Group Id |`mdatp edr group-ids --group-id [group]` |
|
||||
|EDR |Add Group ID |`mdatp edr group-ids --group-id [group]` |
|
||||
|
||||
### How to enable autocompletion
|
||||
|
||||
To enable autocompletion in `Bash`, run the following command and restart the Terminal session:
|
||||
To enable autocompletion in bash, run the following command and restart the Terminal session:
|
||||
|
||||
```bash
|
||||
echo "source /Applications/Microsoft\ Defender\ ATP.app/Contents/Resources/Tools/mdatp_completion.bash" >> ~/.bash_profile
|
||||
```
|
||||
|
||||
To enable autocompletion in `zsh`:
|
||||
To enable autocompletion in zsh:
|
||||
|
||||
- Check whether autocompletion is enabled on your device:
|
||||
|
||||
@ -131,7 +131,7 @@ To enable autocompletion in `zsh`:
|
||||
cat ~/.zshrc | grep autoload
|
||||
```
|
||||
|
||||
- If the above command does not produce any output, you can enable autocompletion using the following command:
|
||||
- If the preceding command does not produce any output, you can enable autocompletion using the following command:
|
||||
|
||||
```zsh
|
||||
echo "autoload -Uz compinit && compinit" >> ~/.zshrc
|
||||
@ -152,4 +152,4 @@ To enable autocompletion in `zsh`:
|
||||
|
||||
## Microsoft Defender for Endpoint portal information
|
||||
|
||||
[This blog](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/edr-capabilities-for-macos-have-now-arrived/ba-p/1047801) provides detailed guidance on what to expect in Microsoft Defender for Endpoint Security Center.
|
||||
[EDR capabilities for macOS have now arrived](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/edr-capabilities-for-macos-have-now-arrived/ba-p/1047801), on the Microsoft Defender for Endpoint blog, provides detailed guidance on what to expect in Microsoft Defender for Endpoint Security Center.
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user