mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
merge
This commit is contained in:
Joey Caparas
commit
d71cf16f4d
@ -11,6 +11,81 @@
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md",
|
||||
"redirect_url": "/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/encrypted-hard-drive.md",
|
||||
"redirect_url": "/windows/security/information-protection/encrypted-hard-drive",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md",
|
||||
"redirect_url": "/windows/security/information-protection/secure-the-windows-10-boot-process",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/change-the-tpm-owner-password",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/how-windows-uses-the-tpm",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-commands",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-lockout",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/tpm-fundamentals",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/tpm-recommendations",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-overview",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md",
|
||||
"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-top-node",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/deployment/update/waas-windows-insider-for-business.md",
|
||||
"redirect_url": "/windows-insider/at-work-pro/wip-4-biz-get-started",
|
||||
"redirect_document_id": true
|
||||
|
||||
@ -4,23 +4,24 @@
|
||||
|
||||
[!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](../shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)]
|
||||
|
||||
### Supported values
|
||||
|
||||
|Group Policy |MDM |Registry |Description |Most restricted |
|
||||
|---|:---:|:---:|---|:---:|
|
||||
|Disabled or not configured<br>**(default)** |0 |0 |No data collected or sent | |
|
||||
|Enabled |1 |1 |Send intranet history only | |
|
||||
|Enabled |2 |2 |Send Internet history only | |
|
||||
|Enabled |3 |3 |Send both intranet and Internet history | |
|
||||
---
|
||||
|
||||
>>You can find this setting in the following location of the Group Policy Editor:
|
||||
>>
|
||||
>> **_Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\_**
|
||||
|
||||
>[!IMPORTANT]
|
||||
>For this policy to work, enable the Allow Telemetry policy with the _Enhanced_ option and enable the Configure the Commercial ID policy by providing the Commercial ID.
|
||||
|
||||
### Supported values
|
||||
|
||||
>[!div class="mx-tableFixed"]
|
||||
>|Group Policy |MDM |Registry |Description |Most restricted |
|
||||
>|---|:---:|:---:|---|:---:|
|
||||
>|Disabled or not configured<br>**(default)** |0 |0 |No data collected or sent | |
|
||||
>|Enabled |1 |1 |Send intranet history only | |
|
||||
>|Enabled |2 |2 |Send Internet history only | |
|
||||
>|Enabled |3 |3 |Send both intranet and Internet history | |
|
||||
---
|
||||
|
||||
>>You can find this policy and the related policies in the following location of the Group Policy Editor:
|
||||
>>
|
||||
>>**_Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\_**
|
||||
>><ul><li>Allow Telemetry = Enabled, _Enhanced_</li><li>Configure the Commercial ID = String of the Commercial ID</li><li>Configure collection of browsing data for Microsoft 365 Analytics</li></ul>
|
||||
|
||||
### ADMX info and settings
|
||||
#### ADMX info
|
||||
|
||||
@ -19,6 +19,9 @@ For a step-by-step guide for setting up devices to run in kiosk mode, see [Set u
|
||||
|
||||
In Windows 10, version 1709, the AssignedAccess configuration service provider (CSP) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. For a step-by-step guide, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps).
|
||||
|
||||
> [!Warning]
|
||||
> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
|
||||
|
||||
> [!Note]
|
||||
> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709 it is also supported in Windows 10 Pro and Windows 10 S. Starting in Windows 10, version 1803, it is also supported in Windows Holographic for Business edition.
|
||||
|
||||
|
||||
@ -1638,6 +1638,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td style="vertical-align:top">[AssignedAccess CSP](assignedaccess-csp.md)</td>
|
||||
<td style="vertical-align:top"><p>Added the following note:</p>
|
||||
<ul>
|
||||
<li>You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.</li>
|
||||
</ul>
|
||||
</td></tr>
|
||||
<tr>
|
||||
<td style="vertical-align:top">[PassportForWork CSP](passportforwork-csp.md)</td>
|
||||
<td style="vertical-align:top"><p>Added new settings in Windows 10, next major version.</p>
|
||||
</td></tr>
|
||||
@ -1675,18 +1682,23 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
|
||||
<ul>
|
||||
<li>ApplicationManagement/LaunchAppAfterLogOn</li>
|
||||
<li>ApplicationManagement/ScheduleForceRestartForUpdateFailures </li>
|
||||
<li>Authentication/EnableFastFirstSignIn</li>
|
||||
<li>Authentication/EnableWebSignIn</li>
|
||||
<li>Authentication/PreferredAadTenantDomainName</li>
|
||||
<li>Defender/CheckForSignaturesBeforeRunningScan</li>
|
||||
<li>Defender/DisableCatchupFullScan </li>
|
||||
<li>Defender/DisableCatchupQuickScan </li>
|
||||
<li>Defender/EnableLowCPUPriority</li>
|
||||
<li>Defender/SignatureUpdateFallbackOrder</li>
|
||||
<li>Defender/SignatureUpdateFileSharesSources</li>
|
||||
<li>DeviceGuard/EnableSystemGuard</li>
|
||||
<li>DeviceInstallation/AllowInstallationOfMatchingDeviceIDs</li>
|
||||
<li>DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses</li>
|
||||
<li>DeviceInstallation/PreventDeviceMetadataFromNetwork</li>
|
||||
<li>DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings</li>
|
||||
<li>DmaGuard/DeviceEnumerationPolicy</li>
|
||||
<li>Experience/AllowClipboardHistory</li>
|
||||
<li>Security/RecoveryEnvironmentAuthentication</li>
|
||||
<li>TaskManager/AllowEndTask</li>
|
||||
<li>WindowsDefenderSecurityCenter/DisableClearTpmButton</li>
|
||||
<li>WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning</li>
|
||||
|
||||
@ -2915,6 +2915,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-security.md#security-preventautomaticdeviceencryptionforazureadjoineddevices" id="security-preventautomaticdeviceencryptionforazureadjoineddevices">Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-security.md#security-recoveryenvironmentauthentication" id="security-recoveryenvironmentauthentication">Security/RecoveryEnvironmentAuthentication</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-security.md#security-requiredeviceencryption" id="security-requiredeviceencryption">Security/RequireDeviceEncryption</a>
|
||||
</dd>
|
||||
|
||||
@ -11,6 +11,8 @@ ms.date: 07/30/2018
|
||||
|
||||
# Policy CSP - Security
|
||||
|
||||
> [!WARNING]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
|
||||
<hr/>
|
||||
@ -43,6 +45,9 @@ ms.date: 07/30/2018
|
||||
<dd>
|
||||
<a href="#security-preventautomaticdeviceencryptionforazureadjoineddevices">Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#security-recoveryenvironmentauthentication">Security/RecoveryEnvironmentAuthentication</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#security-requiredeviceencryption">Security/RequireDeviceEncryption</a>
|
||||
</dd>
|
||||
@ -488,6 +493,87 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="security-recoveryenvironmentauthentication"></a>**Security/RecoveryEnvironmentAuthentication**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Home</th>
|
||||
<th>Pro</th>
|
||||
<th>Business</th>
|
||||
<th>Enterprise</th>
|
||||
<th>Education</th>
|
||||
<th>Mobile</th>
|
||||
<th>Mobile Enterprise</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><img src="images/crossmark.png" alt="cross mark" /></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>5</sup></td>
|
||||
<td></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * User
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
Added in Windows 10, next major version. This policy controls the Admin Authentication requirement in RecoveryEnvironment.
|
||||
|
||||
Supported values:
|
||||
- 0 - Default: Keep using default(current) behavior
|
||||
- 1 - RequireAuthentication: Admin Authentication is always required for components in RecoveryEnvironment
|
||||
- 2 - NoRequireAuthentication: Admin Authentication is not required for components in RecoveryEnvironment
|
||||
|
||||
<!--/Description-->
|
||||
<!--SupportedValues-->
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--Example-->
|
||||
|
||||
<!--/Example-->
|
||||
<!--Validation-->
|
||||
**Validation procedure**
|
||||
|
||||
The validation requires a check whether Refresh ("Keep my files") and Reset ("Remove everything") requires admin authentication in WinRE.
|
||||
The process of starting Push Button Reset (PBR) in WinRE:
|
||||
|
||||
1. Open a cmd as Administrator, run command "reagentc /boottore" and restart the OS to boot to WinRE.
|
||||
1. OS should boot to the blue screen of WinRE UI, go through TroubleShoot -> Reset this PC, it should show two options: "Keep my files" and "Remove everything".
|
||||
|
||||
If the MDM policy is set to "Default" (0) or does not exist, the admin authentication flow should work as default behavior:
|
||||
|
||||
1. Start PBR in WinRE, choose "Keep my files", it should pop up admin authentication.
|
||||
1. Click "<-" (right arrow) button and choose "Remove everything", it should not pop up admin authentication and just go to PBR options.
|
||||
|
||||
If the MDM policy is set to "RequireAuthentication" (1)
|
||||
|
||||
1. Start PBR in WinRE, choose "Keep my files", it should pop up admin authentication.
|
||||
1. Click "<-" (right arrow) button and choose "Remove everything", it should also pop up admin authentication.
|
||||
|
||||
If the MDM policy is set to "NoRequireAuthentication" (2)
|
||||
|
||||
1. Start PBR in WinRE, choose "Keep my files", it should not pop up admin authentication.
|
||||
1. Go through PBR options and click "cancel" at final confirmation page, wait unit the UI is back.
|
||||
1. Click "TroubleShoot" -> "Reset this PC" again, choose "Remove everything", it should not pop up admin authentication neither.
|
||||
|
||||
<!--/Validation-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="security-requiredeviceencryption"></a>**Security/RequireDeviceEncryption**
|
||||
|
||||
@ -661,6 +747,7 @@ Footnote:
|
||||
- 2 - Added in Windows 10, version 1703.
|
||||
- 3 - Added in Windows 10, version 1709.
|
||||
- 4 - Added in Windows 10, version 1803.
|
||||
- 5 - Added in the next major release of Windows 10.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.localizationpriority: medium
|
||||
ms.prod: w10
|
||||
author: jaimeo
|
||||
ms.author: jaimeo
|
||||
ms.date: 08/30/2017
|
||||
ms.date: 07/31/2018
|
||||
---
|
||||
|
||||
# Use Upgrade Readiness to manage Windows upgrades
|
||||
@ -22,7 +22,7 @@ When you are ready to begin the upgrade process, a workflow is provided to guide
|
||||
|
||||
Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step.
|
||||
|
||||
>**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are runnign a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB).
|
||||
>**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB).
|
||||
|
||||
The following information and workflow is provided:
|
||||
|
||||
@ -41,11 +41,11 @@ The target version setting is used to evaluate the number of computers that are
|
||||
|
||||
|
||||
|
||||
As mentioned previously, the default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version.
|
||||
The default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version.
|
||||
|
||||
The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version.
|
||||
|
||||
You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, and Windows 10 version 1703.
|
||||
You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, Windows 10 version 1703, Windows 10 version 1709 and Windows 10 version 1803.
|
||||
|
||||
To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution:
|
||||
|
||||
|
||||
@ -1,7 +1,6 @@
|
||||
# [Security](index.yml)
|
||||
## [Identity and access management](identity-protection/index.md)
|
||||
## [Information protection](information-protection/index.md)
|
||||
## [Hardware-based protection](hardware-protection/index.md)
|
||||
## [Threat protection](threat-protection/index.md)
|
||||
|
||||
|
||||
|
||||
@ -1,21 +0,0 @@
|
||||
# [Hardware-based protection](index.md)
|
||||
|
||||
## [Encrypted Hard Drive](encrypted-hard-drive.md)
|
||||
|
||||
## [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md)
|
||||
|
||||
## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)
|
||||
|
||||
## [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)
|
||||
### [Trusted Platform Module Overview](tpm/trusted-platform-module-overview.md)
|
||||
### [TPM fundamentals](tpm/tpm-fundamentals.md)
|
||||
### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md)
|
||||
### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md)
|
||||
### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md)
|
||||
### [Manage TPM commands](tpm/manage-tpm-commands.md)
|
||||
### [Manage TPM lockout](tpm/manage-tpm-lockout.md)
|
||||
### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md)
|
||||
### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md)
|
||||
### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md)
|
||||
### [TPM recommendations](tpm/tpm-recommendations.md)
|
||||
|
||||
@ -1,51 +0,0 @@
|
||||
---
|
||||
title: How hardware-based containers help protect Windows 10 (Windows 10)
|
||||
description: Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: justinha
|
||||
ms.date: 06/29/2017
|
||||
---
|
||||
|
||||
# How hardware-based containers help protect Windows 10
|
||||
|
||||
Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.
|
||||
Windows 10 protects critical resources, such as the Windows authentication stack, single sign-on tokens, Windows Hello biometric stack, and Virtual Trusted Platform Module, by using a container type called Windows Defender System Guard.
|
||||
|
||||
Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make the these security guarantees:
|
||||
|
||||
- Protect and maintain the integrity of the system as it starts up
|
||||
- Protect and maintain the integrity of the system after it's running
|
||||
- Validate that system integrity has truly been maintained through local and remote attestation
|
||||
|
||||
## Maintaining the integrity of the system as it starts
|
||||
|
||||
With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege.
|
||||
|
||||
With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) we have a hardware-based root of trust that helps us ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. This hardware-based root of trust comes from the device’s [Secure Boot feature](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-8.1-and-8/hh824987), which is part of the Unified Extensible Firmware Interface (UEFI).
|
||||
|
||||
After successful verification and startup of the device’s firmware and Windows bootloader, the next opportunity for attackers to tamper with the system’s integrity is while the rest of the Windows operating system and defenses are starting. As an attacker, embedding your malicious code using a rootkit within the boot process enables you to gain the maximum level of privilege and gives you the ability to more easily persist and evade detection.
|
||||
|
||||
This is where Windows Defender System Guard protection begins with its ability to ensure that only properly signed and secure Windows files and drivers, including third party, can start on the device. At the end of the Windows boot process, System Guard will start the system’s antimalware solution, which scans all third party drivers, at which point the system boot process is completed. In the end, Windows Defender System Guard helps ensure that the system securely boots with integrity and that it hasn’t been compromised before the remainder of your system defenses start.
|
||||
|
||||
|
||||
|
||||
## Maintaining integrity of the system after it’s running (run time)
|
||||
|
||||
Prior to Windows 10, if an attacker exploited the system and gained SYSTEM level privilege or they compromised the kernel itself, it was game over. The level of control that an attacker would acquire in this condition would enable them to tamper with and bypass many, if not all, of your system defenses. While we have a number of development practices and technologies (such as Windows Defender Exploit Guard) that have made it difficult to gain this level of privilege in Windows 10, the reality is that we needed a way to maintain the integrity of the most sensitive Windows services and data, even when the highest level of privilege has been secured by an adversary.
|
||||
|
||||
With Windows 10, we introduced the concept of virtualization-based security (VBS), which enables us to contain the most sensitive Windows services and data in hardware-based isolation, which is the Windows Defender System Guard container. This secure environment provides us with the hardware-based security boundary we need to be able to secure and maintain the integrity of critical system services at run time like Credential Guard, Device Guard, Virtual TPM and parts of Windows Defender Exploit Guard, just to name a few.
|
||||
|
||||
|
||||
|
||||
## Validating platform integrity after Windows is running (run time)
|
||||
|
||||
While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity.
|
||||
|
||||
As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or System Center Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources.
|
||||
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 69 KiB |
@ -1,21 +0,0 @@
|
||||
---
|
||||
title: Hardware-based Protection (Windows 10)
|
||||
description: Learn more about how to help protect against threats in Windows 10 and Windows 10 Mobile.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 02/05/2018
|
||||
---
|
||||
|
||||
# Hardware-based protection
|
||||
|
||||
Windows 10 leverages these hardware-based security features to protect and maintain system integrity.
|
||||
|
||||
| Section | Description |
|
||||
|-|-|
|
||||
| [Encrypted Hard Drive](encrypted-hard-drive.md) | Provides information about Encrypted Hard Drive, which uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.|
|
||||
|[How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) |Learn about how hardware-based containers can isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.|
|
||||
|[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) |Learn about the Windows 10 security features that help to protect your PC from malware, including rootkits and other applications.|
|
||||
| [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Provides links to information about the Trusted Platform Module (TPM), which is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. |
|
||||
@ -17,7 +17,7 @@
|
||||
|
||||
## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md)
|
||||
|
||||
## [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md)
|
||||
## [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md)
|
||||
|
||||
## [Protect derived domain credentials with Credential Guard](credential-guard/credential-guard.md)
|
||||
### [How Credential Guard works](credential-guard/credential-guard-how-it-works.md)
|
||||
@ -28,7 +28,6 @@
|
||||
### [Credential Guard: Additional mitigations](credential-guard/additional-mitigations.md)
|
||||
### [Credential Guard: Known issues](credential-guard/credential-guard-known-issues.md)
|
||||
|
||||
|
||||
## [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md)
|
||||
|
||||
## [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md)
|
||||
|
||||
@ -7,54 +7,46 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: justinha
|
||||
ms.date: 06/29/2017
|
||||
ms.date: 08/01/2018
|
||||
---
|
||||
|
||||
# How hardware-based containers help protect Windows 10
|
||||
|
||||
# Windows Defender System Guard: How hardware-based containers help protect Windows 10
|
||||
|
||||
Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.
|
||||
Windows 10 protects critical resources, such as the Windows authentication stack, single sign-on tokens, Windows Hello biometric stack, and Virtual Trusted Platform Module, by using a container type called Windows Defender System Guard.
|
||||
|
||||
Protecting system services and data with Windows Defender System Guard is an important first step, but is just the beginning of what we need to do as it doesn’t protect the rest of the operating system, information on the device, other apps, or the network.
|
||||
Since systems are generally compromised through the application layer, and often though browsers, Windows 10 includes Windows Defender Application Guard to isolate Microsoft Edge from the operating system, information on the device, and the network.
|
||||
With this, Windows can start to protect the broader range of resources.
|
||||
Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make the these security guarantees:
|
||||
|
||||
The following diagram shows Windows Defender System Guard and Windows Defender Application Guard in relation to the Windows 10 operating system.
|
||||
- Protect and maintain the integrity of the system as it starts up
|
||||
- Protect and maintain the integrity of the system after it's running
|
||||
- Validate that system integrity has truly been maintained through local and remote attestation
|
||||
|
||||
|
||||
## Maintaining the integrity of the system as it starts
|
||||
|
||||
## What security threats do containers protect against
|
||||
With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege.
|
||||
|
||||
Exploiting zero days and vulnerabilities are an increasing threat that attackers are attempting to take advantage of.
|
||||
The following diagram shows the traditional Windows software stack: a kernel with an app platform, and an app running on top of it.
|
||||
Let’s look at how an attacker might elevate privileges and move down the stack.
|
||||
With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) we have a hardware-based root of trust that helps us ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. This hardware-based root of trust comes from the device’s Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI).
|
||||
|
||||
|
||||
After successful verification and startup of the device’s firmware and Windows bootloader, the next opportunity for attackers to tamper with the system’s integrity is while the rest of the Windows operating system and defenses are starting. As an attacker, embedding your malicious code using a rootkit within the boot process enables you to gain the maximum level of privilege and gives you the ability to more easily persist and evade detection.
|
||||
|
||||
In desktop operating systems, those apps typically run under the context of the user’s privileges.
|
||||
If the app was malicious, it would have access to all the files in the file system, all the settings that you as a user Standard user have access to, and so on.
|
||||
This is where Windows Defender System Guard protection begins with its ability to ensure that only properly signed and secure Windows files and drivers, including third party, can start on the device. At the end of the Windows boot process, System Guard will start the system’s antimalware solution, which scans all third party drivers, at which point the system boot process is completed. In the end, Windows Defender System Guard helps ensure that the system securely boots with integrity and that it hasn’t been compromised before the remainder of your system defenses start.
|
||||
|
||||
A different type of app may run under the context of an Administrator.
|
||||
If attackers exploit a vulnerability in that app, they could gain Administrator privileges.
|
||||
Then they can start turning off defenses.
|
||||
|
||||
|
||||
They can poke down a little bit lower in the stack and maybe elevate to System, which is greater than Administrator.
|
||||
Or if they can exploit the kernel mode, they can turn on and turn off all defenses, while at the same time making the computer look healthy.
|
||||
SecOps tools could report the computer as healthy when in fact it’s completely under the control of someone else.
|
||||
## Maintaining integrity of the system after it’s running (run time)
|
||||
|
||||
One way to address this threat is to use a sandbox, as smartphones do.
|
||||
That puts a layer between the app layer and the Windows platform services.
|
||||
Universal Windows Platform (UWP) applications work this way.
|
||||
But what if a vulnerability in the sandbox exists?
|
||||
The attacker can escape and take control of the system.
|
||||
Prior to Windows 10, if an attacker exploited the system and gained SYSTEM level privilege or they compromised the kernel itself, it was game over. The level of control that an attacker would acquire in this condition would enable them to tamper with and bypass many, if not all, of your system defenses. While we have a number of development practices and technologies (such as Windows Defender Exploit Guard) that have made it difficult to gain this level of privilege in Windows 10, the reality is that we needed a way to maintain the integrity of the most sensitive Windows services and data, even when the highest level of privilege has been secured by an adversary.
|
||||
|
||||
## How containers help protect Windows 10
|
||||
|
||||
Windows 10 addresses this by using virtualization based security to isolate more and more components out of Windows (left side) over time and moving those components into a separate, isolated hardware container.
|
||||
The container helps prevent zero days and vulnerabilities from allowing an attacker to take control of a device.
|
||||
|
||||
Anything that's running in that container on the right side will be safe, even from Windows, even if the kernel's compromised.
|
||||
Anything that's running in that container will also be secure against a compromised app.
|
||||
Initially, Windows Defender System Guard will protect things like authentication and other system services and data that needs to resist malware, and more things will be protected over time.
|
||||
With Windows 10, we introduced the concept of virtualization-based security (VBS), which enables us to contain the most sensitive Windows services and data in hardware-based isolation, which is the Windows Defender System Guard container. This secure environment provides us with the hardware-based security boundary we need to be able to secure and maintain the integrity of critical system services at run time like Credential Guard, Device Guard, Virtual TPM and parts of Windows Defender Exploit Guard, just to name a few.
|
||||
|
||||
|
||||
|
||||
## Validating platform integrity after Windows is running (run time)
|
||||
|
||||
While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity.
|
||||
|
||||
As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or System Center Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources.
|
||||
|
||||
|
||||
|
||||
|
||||
|
Before Width: | Height: | Size: 46 KiB After Width: | Height: | Size: 46 KiB |
|
Before Width: | Height: | Size: 41 KiB After Width: | Height: | Size: 41 KiB |
@ -28,6 +28,7 @@
|
||||
#### [Choose the Right BitLocker Countermeasure](bitlocker\choose-the-right-bitlocker-countermeasure.md)
|
||||
### [Protecting cluster shared volumes and storage area networks with BitLocker](bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)
|
||||
|
||||
## [Encrypted Hard Drive](encrypted-hard-drive.md)
|
||||
|
||||
## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md)
|
||||
### [Create a Windows Information Protection (WIP) policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md)
|
||||
@ -53,3 +54,20 @@
|
||||
#### [Using Outlook Web Access with Windows Information Protection (WIP)](windows-information-protection\using-owa-with-wip.md)
|
||||
### [Fine-tune Windows Information Protection (WIP) with WIP Learning](windows-information-protection\wip-learning.md)
|
||||
|
||||
## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md)
|
||||
|
||||
## [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)
|
||||
### [Trusted Platform Module Overview](tpm/trusted-platform-module-overview.md)
|
||||
### [TPM fundamentals](tpm/tpm-fundamentals.md)
|
||||
### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md)
|
||||
### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md)
|
||||
### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md)
|
||||
### [Manage TPM commands](tpm/manage-tpm-commands.md)
|
||||
### [Manage TPM lockout](tpm/manage-tpm-lockout.md)
|
||||
### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md)
|
||||
### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md)
|
||||
### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md)
|
||||
### [TPM recommendations](tpm/tpm-recommendations.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
Before Width: | Height: | Size: 38 KiB After Width: | Height: | Size: 38 KiB |
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 14 KiB |
|
Before Width: | Height: | Size: 90 KiB After Width: | Height: | Size: 90 KiB |
|
Before Width: | Height: | Size: 88 KiB After Width: | Height: | Size: 88 KiB |
@ -444,10 +444,10 @@
|
||||
###### [Audit process tracking](auditing/basic-audit-process-tracking.md)
|
||||
###### [Audit system events](auditing/basic-audit-system-events.md)
|
||||
|
||||
##### [Advanced security audit policies](auditing/advanced-security-auditing.md)
|
||||
###### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md)
|
||||
###### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md)
|
||||
####### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md)
|
||||
#### [Advanced security audit policies](auditing/advanced-security-auditing.md)
|
||||
##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md)
|
||||
##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md)
|
||||
###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md)
|
||||
|
||||
###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md)
|
||||
####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md)
|
||||
@ -788,7 +788,7 @@
|
||||
|
||||
|
||||
|
||||
#### [Security policy settings](security-policy-settings/security-policy-settings.md)
|
||||
### [Security policy settings](security-policy-settings/security-policy-settings.md)
|
||||
#### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md)
|
||||
##### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md)
|
||||
#### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md)
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 05/30/2018
|
||||
ms.date: 08/01/2018
|
||||
---
|
||||
|
||||
# Investigate machines in the Windows Defender ATP Machines list
|
||||
@ -178,6 +178,9 @@ Use the following registry key entry to add a tag on a machine:
|
||||
- Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\`
|
||||
- Registry key value (string): Group
|
||||
|
||||
>[!NOTE]
|
||||
>The device tag is part of the machine information report that’s generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report.
|
||||
|
||||
|
||||
### Add machine tags using the portal
|
||||
Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag.
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: v-tanewt
|
||||
author: tbit0001
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 11/28/2017
|
||||
ms.date: 08/01/2018
|
||||
---
|
||||
|
||||
# Troubleshoot subscription and portal access issues
|
||||
@ -72,5 +72,14 @@ If the portal dashboard, and other sections show an error message such as "Data
|
||||
You'll need to whitelist the `securitycenter.windows.com` and all sub-domains under it. For example `*.securitycenter.windows.com`.
|
||||
|
||||
|
||||
## Portal communication issues
|
||||
If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following urls are whitelisted and open for communciation.
|
||||
|
||||
- `*.blob.core.windows.net
|
||||
crl.microsoft.com`
|
||||
- `https://*.microsoftonline-p.com`
- `https://*.securitycenter.windows.com`
- `https://automatediracs-eus-prd.securitycenter.windows.com`
- `https://login.microsoftonline.com`
- `https://login.windows.net`
- `https://onboardingpackagescusprd.blob.core.windows.net`
|
||||
- `https://secure.aadcdn.microsoftonline-p.com`
|
||||
- `https://securitycenter.windows.com`
- `https://static2.sharepointonline.com`
|
||||
|
||||
## Related topics
|
||||
- [Validate licensing provisioning and complete setup for Windows Defender ATP](licensing-windows-defender-advanced-threat-protection.md)
|
||||
Loading…
x
Reference in New Issue
Block a user