diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md index 8c86acd85f..e06d4cfd48 100644 --- a/education/includes/education-content-updates.md +++ b/education/includes/education-content-updates.md @@ -2,6 +2,45 @@ +## Week of August 08, 2022 + + +| Published On |Topic title | Change | +|------|------------|--------| +| 8/10/2022 | [Reset devices with Autopilot Reset](/education/windows/autopilot-reset) | modified | +| 8/10/2022 | [Change history for Windows 10 for Education (Windows 10)](/education/windows/change-history-edu) | modified | +| 8/10/2022 | [Change to Windows 10 Education from Windows 10 Pro](/education/windows/change-to-pro-education) | modified | +| 8/10/2022 | [Chromebook migration guide (Windows 10)](/education/windows/chromebook-migration-guide) | modified | +| 8/10/2022 | [Windows 10 configuration recommendations for education customers](/education/windows/configure-windows-for-education) | modified | +| 8/10/2022 | [Deploy Windows 10 in a school district (Windows 10)](/education/windows/deploy-windows-10-in-a-school-district) | modified | +| 8/10/2022 | [Deploy Windows 10 in a school (Windows 10)](/education/windows/deploy-windows-10-in-a-school) | modified | +| 8/10/2022 | [Deployment recommendations for school IT administrators](/education/windows/edu-deployment-recommendations) | modified | +| 8/10/2022 | [Education scenarios Microsoft Store for Education](/education/windows/education-scenarios-store-for-business) | modified | +| 8/10/2022 | [Enable S mode on Surface Go devices for Education](/education/windows/enable-s-mode-on-surface-go-devices) | modified | +| 8/10/2022 | [Get Minecraft Education Edition](/education/windows/get-minecraft-for-education) | modified | +| 8/10/2022 | [Windows 10 for Education (Windows 10)](/education/windows/index) | modified | +| 8/10/2022 | [Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode](/education/windows/s-mode-switch-to-edu) | modified | +| 8/10/2022 | [For IT administrators get Minecraft Education Edition](/education/windows/school-get-minecraft) | modified | +| 8/10/2022 | [Azure AD Join with Set up School PCs app](/education/windows/set-up-school-pcs-azure-ad-join) | modified | +| 8/10/2022 | [What's in Set up School PCs provisioning package](/education/windows/set-up-school-pcs-provisioning-package) | modified | +| 8/10/2022 | [Shared PC mode for school devices](/education/windows/set-up-school-pcs-shared-pc-mode) | modified | +| 8/10/2022 | [Set up School PCs app technical reference overview](/education/windows/set-up-school-pcs-technical) | modified | +| 8/10/2022 | [What's new in the Windows Set up School PCs app](/education/windows/set-up-school-pcs-whats-new) | modified | +| 8/10/2022 | [Set up student PCs to join domain](/education/windows/set-up-students-pcs-to-join-domain) | modified | +| 8/10/2022 | [Provision student PCs with apps](/education/windows/set-up-students-pcs-with-apps) | modified | +| 8/10/2022 | [Set up Windows devices for education](/education/windows/set-up-windows-10) | modified | +| 8/10/2022 | [Take a Test app technical reference](/education/windows/take-a-test-app-technical) | modified | +| 8/10/2022 | [Set up Take a Test on multiple PCs](/education/windows/take-a-test-multiple-pcs) | modified | +| 8/10/2022 | [Set up Take a Test on a single PC](/education/windows/take-a-test-single-pc) | modified | +| 8/10/2022 | [Take tests in Windows 10](/education/windows/take-tests-in-windows-10) | modified | +| 8/10/2022 | [For teachers get Minecraft Education Edition](/education/windows/teacher-get-minecraft) | modified | +| 8/10/2022 | [Test Windows 10 in S mode on existing Windows 10 education devices](/education/windows/test-windows10s-for-edu) | modified | +| 8/10/2022 | [Use Set up School PCs app](/education/windows/use-set-up-school-pcs-app) | modified | +| 8/10/2022 | [What is Windows 11 SE](/education/windows/windows-11-se-overview) | modified | +| 8/10/2022 | [Windows 11 SE settings list](/education/windows/windows-11-se-settings-list) | modified | +| 8/10/2022 | [Windows 10 editions for education customers](/education/windows/windows-editions-for-education-customers) | modified | + + ## Week of July 25, 2022 @@ -11,11 +50,3 @@ | 7/26/2022 | [Secure the Windows boot process](/education/windows/change-home-to-edu) | modified | | 7/25/2022 | Edit an existing topic using the Edit link | removed | | 7/26/2022 | [Windows Hello for Business Videos](/education/windows/change-home-to-edu) | modified | - - -## Week of June 27, 2022 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 6/30/2022 | Get Minecraft Education Edition with your Windows 10 device promotion | removed | diff --git a/windows/client-management/mdm/policy-csp-admx-deviceguard.md b/windows/client-management/mdm/policy-csp-admx-deviceguard.md index 58f38e4da3..d39a25209b 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceguard.md @@ -15,7 +15,7 @@ manager: aaroncz # Policy CSP - ADMX_DeviceGuard > [!WARNING] -> Group Policy-based deployment of Windows Defender Application Control policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for [policy deployment](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md). +> Group Policy-based deployment of Windows Defender Application Control policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for [policy deployment](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide). > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 35e59bd128..073d1e0582 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -202,9 +202,13 @@ - name: Use Update Compliance (preview) items: - name: Use Update Compliance - href: update/update-compliance-v2-use.md + href: update/update-compliance-v2-use.md + - name: Update Compliance workbook + href: update/update-compliance-v2-workbook.md - name: Software updates in the Microsoft admin center (preview) - href: update/update-status-admin-center.md + href: update/update-status-admin-center.md + - name: Feedback, support, and troubleshooting + href: update/update-compliance-v2-help.md - name: Update Compliance schema reference (preview) items: - name: Update Compliance schema reference diff --git a/windows/deployment/update/includes/update-compliance-verify-device-configuration.md b/windows/deployment/update/includes/update-compliance-verify-device-configuration.md new file mode 100644 index 0000000000..b0aeb4c8a1 --- /dev/null +++ b/windows/deployment/update/includes/update-compliance-verify-device-configuration.md @@ -0,0 +1,43 @@ +--- +author: mestew +ms.author: mstewart +manager: dougeby +ms.prod: w10 +ms.collection: M365-modern-desktop +ms.topic: include +ms.date: 08/10/2022 +ms.localizationpriority: medium +--- + + +In some cases, you may need to manually verify the device configuration has the `AllowUpdateComplianceProcessing` policy enabled. To verify the setting, use the following steps: + +1. Download and enable the **Diagnostic Data Viewer**. For more information, see [Diagnostic Data Viewer overview](/windows/privacy/diagnostic-data-viewer-overview#install-and-use-the-diagnostic-data-viewer). + 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**. + 1. Under **View diagnostic data**, select **On** for the following option: + + - Windows 11: **Turn on the Diagnostic Data Viewer (uses up to 1 GB of hard drive space)** + - Windows 10: **Turn on this setting to see your data in the Diagnostic Data Viewer. (Setting uses up to 1GB of hard drive space.)** + +1. Select **Open Diagnostic Data Viewer**. + - If the application isn't installed, select **Get** when you're asked to download the [Diagnostic Data Viewer from the Microsoft Store](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. + - If the application is already installed, it will open. You can either close the application before running a scan for software updates, or use the refresh button to fetch the new data after the scan is completed. + +1. Check for software updates on the client device. + - Windows 11: + 1. Go to **Start**, select **Settings** > **Windows Update**. + 1. Select **Check for updates** then wait for the update check to complete. + - Windows 10: + 1. Go to **Start**, select **Settings** > **Update & Security** > **Windows Update**. + 1. Select **Check for updates** then wait for the update check to complete. + +1. Run the **Diagnostic Data Viewer**. + 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**. + 1. Under **View diagnostic data**, select **Open Diagnostic Data Viewer**. +1. When the Diagnostic Data Viewer opens, type `SoftwareUpdateClientTelemetry` in the search field. Verify the following items: + - The **EnrolledTenantID** field under **m365a** should equal the [CommercialID](../update-compliance-v2-enable.md#bkmk_id) of your Log Analytics workspace for Update Compliance. + - The **MSP** field value under **protocol** should be either `16` or `18`. + - If you need to send this data to Microsoft Support, select **Export data**. + + :::image type="content" alt-text="Screenshot of the Diagnostic Data Viewer displaying the data from SoftwareUpdateClientTelemetry. The export data option and the fields for MSP and EnrolledTenantID are outlined in red." source="../media/update-compliance-diagnostic-data-viewer.png" lightbox="../media/update-compliance-diagnostic-data-viewer.png"::: + diff --git a/windows/deployment/update/media/33771278-overall-security-update-status.png b/windows/deployment/update/media/33771278-overall-security-update-status.png new file mode 100644 index 0000000000..49d634956c Binary files /dev/null and b/windows/deployment/update/media/33771278-overall-security-update-status.png differ diff --git a/windows/deployment/update/media/33771278-update-compliance-feedback.png b/windows/deployment/update/media/33771278-update-compliance-feedback.png new file mode 100644 index 0000000000..bab180d192 Binary files /dev/null and b/windows/deployment/update/media/33771278-update-compliance-feedback.png differ diff --git a/windows/deployment/update/media/33771278-update-compliance-workbook-summary.png b/windows/deployment/update/media/33771278-update-compliance-workbook-summary.png new file mode 100644 index 0000000000..bf5f0272ac Binary files /dev/null and b/windows/deployment/update/media/33771278-update-compliance-workbook-summary.png differ diff --git a/windows/deployment/update/media/33771278-update-deployment-status-table.png b/windows/deployment/update/media/33771278-update-deployment-status-table.png new file mode 100644 index 0000000000..4ee85fcc56 Binary files /dev/null and b/windows/deployment/update/media/33771278-update-deployment-status-table.png differ diff --git a/windows/deployment/update/media/33771278-workbook-summary-tab-tiles.png b/windows/deployment/update/media/33771278-workbook-summary-tab-tiles.png new file mode 100644 index 0000000000..7f1dddf600 Binary files /dev/null and b/windows/deployment/update/media/33771278-workbook-summary-tab-tiles.png differ diff --git a/windows/deployment/update/media/docs-feedback.png b/windows/deployment/update/media/docs-feedback.png new file mode 100644 index 0000000000..2c6afbc101 Binary files /dev/null and b/windows/deployment/update/media/docs-feedback.png differ diff --git a/windows/deployment/update/update-compliance-v2-configuration-script.md b/windows/deployment/update/update-compliance-v2-configuration-script.md index aafe9ff807..7e9fd6a12b 100644 --- a/windows/deployment/update/update-compliance-v2-configuration-script.md +++ b/windows/deployment/update/update-compliance-v2-configuration-script.md @@ -49,36 +49,8 @@ Open `RunConfig.bat` and configure the following (assuming a first-run, with `ru ## Verify device configuration -In some cases, you may need to manually verify the device configuration has the `AllowUpdateComplianceProcessing` policy enabled. To verify the setting, use the following steps: - -1. Download and enable the **Diagnostic Data Viewer**. For more information, see [Diagnostic Data Viewer overview](/windows/privacy/diagnostic-data-viewer-overview#install-and-use-the-diagnostic-data-viewer). - 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**. - 1. Under **View diagnostic data**, select **On** for the following option: - - - Windows 11: **Turn on the Diagnostic Data Viewer (uses up to 1 GB of hard drive space)** - - Windows 10: **Turn on this setting to see your data in the Diagnostic Data Viewer. (Setting uses up to 1GB of hard drive space.)** - -1. Select **Open Diagnostic Data Viewer**. - - If the application isn't installed, select **Get** when you're asked to download the [Diagnostic Data Viewer from the Microsoft Store](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. - - If the application is already installed, it will open. You can either close the application before running a scan for software updates, or use the refresh button to fetch the new data after the scan is completed. - -1. Check for software updates on the client device. - - Windows 11: - 1. Go to **Start**, select **Settings** > **Windows Update**. - 1. Select **Check for updates** then wait for the update check to complete. - - Windows 10: - 1. Go to **Start**, select **Settings** > **Update & Security** > **Windows Update**. - 1. Select **Check for updates** then wait for the update check to complete. - -1. Run the **Diagnostic Data Viewer**. - 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**. - 1. Under **View diagnostic data**, select **Open Diagnostic Data Viewer**. -1. When the Diagnostic Data Viewer opens, type `SoftwareUpdateClientTelemetry` in the search field. Verify the following items: - - The **EnrolledTenantID** field under **m365a** should equal the [CommercialID](update-compliance-v2-enable.md#bkmk_id) of your Log Analytics workspace for Update Compliance. - - The **MSP** field value under **protocol** should be either `16` or `18`. - - If you need to send this data to Microsoft Support, select **Export data**. - - :::image type="content" alt-text="Screenshot of the Diagnostic Data Viewer displaying the data from SoftwareUpdateClientTelemetry. The export data option and the fields for MSP and EnrolledTenantID are outlined in red." source="./media/update-compliance-diagnostic-data-viewer.png" lightbox="./media/update-compliance-diagnostic-data-viewer.png"::: + +[!INCLUDE [Endpoints for Update Compliance](./includes/update-compliance-verify-device-configuration.md)] ## Script errors diff --git a/windows/deployment/update/update-compliance-v2-help.md b/windows/deployment/update/update-compliance-v2-help.md new file mode 100644 index 0000000000..25e1dff44a --- /dev/null +++ b/windows/deployment/update/update-compliance-v2-help.md @@ -0,0 +1,109 @@ +--- +title: Update Compliance (preview) feedback, support, and troubleshooting +ms.reviewer: +manager: dougeby +description: Update Compliance (preview) support information. +ms.prod: w10 +author: mestew +ms.author: mstewart +ms.collection: M365-analytics +ms.topic: article +ms.date: 08/10/2022 +--- + +# Update Compliance (preview) feedback, support, and troubleshooting + + +***(Applies to: Windows 11 & Windows 10)*** + +> [!IMPORTANT] +> This information relates to a preview feature that's available for early testing and use in a production environment. This feature is fully supported but it's still in active development and may receive substantial changes until it becomes generally available. + +There are several resources that you can use to find help with Update Compliance. Whether you're just getting started or an experienced administrator, use the following resources when you need help with Update Compliance: + +- Send [product feedback about Update Compliance](#send-product-feedback) +- Open a [Microsoft support case](#open-a-microsoft-support-case) + +- [Documentation feedback](#documentation-feedback) +- [Troubleshooting tips](#troubleshooting-tips) for Update Compliance +- Follow the [Windows IT Pro blog](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/bg-p/Windows10Blog) to learn about upcoming changes to Update Compliance +- Use Microsoft Q&A to [ask product questions](/answers/products/) + +## Send product feedback + +Use the product feedback option to offer suggestions for new features and functionality, or for suggesting changes to the current Update Compliance features. You can share feedback directly to the Update Compliance product group. To provide product feedback: + +1. In the upper right corner of the Azure portal, select the feedback icon. +1. Select either the smile or the frown to rate your satisfaction with your experience. +1. In the text box, describe what you did or didn't like. When providing feedback about a problem, be sure to include enough detail in your description so it can be properly identified by the product group. +1. Choose if you'd like to allow Microsoft to email you about your feedback. +1. Select **Submit feedback** when you've completed the feedback form. +:::image type="content" source="media/33771278-update-compliance-feedback.png" alt-text="Screenshot of the Azure portal showing the product feedback option flyout." lightbox="media/33771278-update-compliance-feedback.png"::: + +## Open a Microsoft support case + +You can open support requests directly from the Azure portal. If the **Help + Support** page doesn't display, verify you have access to open support requests. For more information about role-based access controls for support requests, see [Create an Azure support request](/azure/azure-portal/supportability/how-to-create-azure-support-request). To create a new support request for Update Compliance: + +1. Open the **Help + Support** page from the following locations: + - In the [Send product feedback](#send-product-feedback) flyout, select the **contact support** link. + - From the Azure portal, select **New support request** under the **Support + Troubleshooting** heading. +1. Select **Create a support request** which opens the new support request page. +1. On the **Problem description** tab, provide information about the issue. The below items in ***bold italics*** should be used to help ensure an Update Compliance engineer receives your support request: + - **Summary** - Brief description of the issue + - **Issue type** - ***Technical*** + - **Subscription** - Select the subscription used for Update Compliance + - **Service** - ***My services*** + - **Service type** - ***Log Analytics*** + - **Problem type** - ***Solutions or Insights*** + - **Problem subtype** - ***Update Compliance*** +1. Based on the information you provided, you'll be shown some **Recommended solutions** you can use to try to resolve the problem. +1. Complete the **Additional details** tab and then create the request on the **Review + create** tab. + +## Documentation feedback + +Select the **Feedback** link in the upper right of any article to go to the Feedback section at the bottom. Feedback is integrated with GitHub Issues. For more information about this integration with GitHub Issues, see the [docs platform blog post](/teamblog/a-new-feedback-system-is-coming-to-docs). + +:::image type="content" source="media/docs-feedback.png" alt-text="Screenshot of the feedback section on a docs article."::: + +To share docs feedback about the current article, select **This page**. A [GitHub account](https://github.com/join) is a prerequisite for providing documentation feedback. Once you sign in, there's a one-time authorization for the MicrosoftDocs organization. It then opens the GitHub new issue form. Add a descriptive title and detailed feedback in the body, but don't modify the document details section. Then select **Submit new issue** to file a new issue for the target article in the [Windows-ITPro-docs GitHub repository](https://github.com/MicrosoftDocs/windows-itpro-docs/issues). + +To see whether there's already feedback for this article, select **View all page feedback**. This action opens a GitHub issue query for this article. By default it displays both open and closed issues. Review any existing feedback before you submit a new issue. If you find a related issue, select the face icon to add a reaction, add a comment to the thread, or **Subscribe** to receive notifications. + +Use GitHub Issues to submit the following types of feedback: + +- Doc bug: The content is out of date, unclear, confusing, or broken. +- Doc enhancement: A suggestion to improve the article. +- Doc question: You need help with finding existing documentation. +- Doc idea: A suggestion for a new article. +- Kudos: Positive feedback about a helpful or informative article. +- Localization: Feedback about content translation. +- Search engine optimization (SEO): Feedback about problems searching for content. Include the search engine, keywords, and target article in the comments. + +If you create an issue for something not related to documentation, Microsoft will close the issue and redirect you to a better feedback channel. For example: + +- [Product feedback](#send-product-feedback) for Update Compliance +- [Product questions (using Microsoft Q&A)](/answers/products/) +- [Support requests](#open-a-microsoft-support-case) for Update Compliance + +To share feedback on the fundamental docs.microsoft.com platform, see [Docs feedback](https://aka.ms/sitefeedback). The platform includes all of the wrapper components such as the header, table of contents, and right menu. Also how the articles render in the browser, such as the font, alert boxes, and page anchors. + +## Troubleshooting tips + +Use the troubleshooting tips below to resolve commonly encountered problems when using Update Compliance: + +### Verify client configuration + + +[!INCLUDE [Endpoints for Update Compliance](./includes/update-compliance-verify-device-configuration.md)] + +### Ensuring devices are configured correctly to send data + +The first step in troubleshooting Update Compliance is ensuring that devices are configured. Review [Manually configuring devices for Update Compliance](update-compliance-v2-configuration-manual.md) for the settings. We recommend using the [Update Compliance configuration script](update-compliance-v2-configuration-script.md) for troubleshooting and configuring devices. + +### Devices have been correctly configured but aren't showing up in Update Compliance + +It takes some time for data to appear in Update Compliance for the first time or if you moved to a new Log Analytics workspace. To learn more about data latencies for Update Compliance, review [Update Compliance data latency](update-compliance-v2-use.md#update-compliance-data-latency). + +### Devices are appearing, but without a device name + +Device Name is an opt-in via policy starting in Windows 10 version 1803. Review the required policies for enabling device name in the [Manually configuring devices for Update Compliance](update-compliance-v2-configuration-manual.md) article. diff --git a/windows/deployment/update/update-compliance-v2-overview.md b/windows/deployment/update/update-compliance-v2-overview.md index dcd9c0e7c9..e4d165eb8c 100644 --- a/windows/deployment/update/update-compliance-v2-overview.md +++ b/windows/deployment/update/update-compliance-v2-overview.md @@ -8,7 +8,7 @@ author: mestew ms.author: mstewart ms.collection: M365-analytics ms.topic: article -ms.date: 06/06/2022 +ms.date: 08/09/2022 --- # Update Compliance overview @@ -34,7 +34,8 @@ The new version of Update Compliance is in technical preview. Some of the benefi Currently, the technical preview contains the following features: -- Access to the following new Update Compliance tables: +- [Update Compliance workbook](update-compliance-v2-workbook.md) +- Access to the following new [Update Compliance tables](update-compliance-v2-schema.md): - UCClient - UCClientReadinessStatus - UCClientUpdateStatus @@ -43,6 +44,8 @@ Currently, the technical preview contains the following features: - UCUpdateAlert - Client data collection to populate the new Update Compliance tables +Currently, these new tables are available to all Updates Compliance users. They will be displayed along with the original Updates Compliance tables. + :::image type="content" source="media/update-compliance-v2-query-table.png" alt-text="Screenshot of using a custom Kusto (KQL) query on Update Compliance data in Log Analytics." lightbox="media/update-compliance-v2-query-table.png"::: > [!IMPORTANT] @@ -69,6 +72,8 @@ Since the data from your clients is stored in a Log Analytics workspace, you can - [Power BI](/azure/azure-monitor/logs/log-powerbi) - Other tools for [querying the data](/azure/azure-monitor/logs/log-query-overview) + + ## Next steps - Review the [Update Compliance prerequisites](update-compliance-v2-prerequisites.md) diff --git a/windows/deployment/update/update-compliance-v2-workbook.md b/windows/deployment/update/update-compliance-v2-workbook.md new file mode 100644 index 0000000000..da0c935974 --- /dev/null +++ b/windows/deployment/update/update-compliance-v2-workbook.md @@ -0,0 +1,148 @@ +--- +title: Use the workbook for Update Compliance (preview) +ms.reviewer: +manager: dougeby +description: How to use the Update Compliance (preview) workbook. +ms.prod: w10 +author: mestew +ms.author: mstewart +ms.collection: M365-analytics +ms.topic: article +ms.date: 08/10/2022 +--- + +# Update Compliance (preview) workbook + +***(Applies to: Windows 11 & Windows 10)*** + +> [!IMPORTANT] +> This information relates to a preview feature that's available for early testing and use in a production environment. This feature is fully supported but it's still in active development and may receive substantial changes until it becomes generally available. + +[Update Compliance](update-compliance-v2-overview.md) presents information commonly needed by updates administrators in an easy to use format. Update Compliance uses [Azure Workbooks](/azure/azure-monitor/visualize/workbooks-getting-started) to give you a visual representation of your compliance data. The workbook is broken down into three tab sections: + +- [Summary](#summary-tab) +- [Quality updates](#quality-updates-tab) +- [Feature updates](#feature-updates-tab) + +:::image type="content" source="media/33771278-update-compliance-workbook-summary.png" alt-text="Screenshot of the summary tab in the Update Compliance workbook with the three tabbed sections outlined in red." lightbox="media/33771278-update-compliance-workbook-summary.png"::: + +## Open the Update Compliance workbook + +To access the Update Compliance workbook: + +1. In the [Azure portal](https://portal.azure.com), select **Monitor** > **Workbooks** from the menu bar. + - You can also type **Monitor** in the search bar. As you begin typing, the list filters based on your input. + +1. When the gallery opens, select the **Update Compliance** workbook. If needed, you can filter workbooks by name in the gallery. +1. When the workbook opens, you may need to specify which **Subscription** and **Workspace** you used when [enabling Update Compliance](update-compliance-v2-enable.md). + +## Summary tab + +The **Summary** tab gives you a brief high-level overview of the devices that you've enrolled into Update Compliance. The **Summary** tab contains tiles above the **Overall security update status** chart. + +### Summary tab tiles + +Each of these tiles contains an option to **View details**. When **View details** is selected for a tile, a flyout appears with additional information. + +:::image type="content" source="media/33771278-workbook-summary-tab-tiles.png" alt-text="Screenshot of the summary tab tiles in the Update Compliance workbook"::: + +| Tile name | Description | View details description | +|---|---|------| +| **Enrolled devices** | Total number of devices that are enrolled into Update Compliance | Displays multiple charts about the operating systems (OS) for enrolled devices:
**OS Version**
**OS Edition**
**OS Servicing Channel**
**OS Architecture**| +|**Active alerts** | Total number of active alerts on enrolled devices | Displays the top three active alert subtypes and the count of devices in each.

Select the count of **Devices** to display a table of the devices. This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial).

Select an **AlertSubtype** to display a list containing:
- Each **Error Code** in the alert subtype
- A **Description** of the error code
- A **Recommendation** to help you remediate the error code
- A count of **Devices** with the specific error code | +| **Windows 11 eligibility** | Percentage of devices that are capable of running Windows 11 | Displays the following items:
- **Windows 11 Readiness Status** chart
- **Readiness Reason(s) Breakdown** chart that displays Windows 11 requirements that aren't met.
- A table for **Readiness reason**. Select a reason to display a list of devices that don't meet a specific requirement for Windows 11. | + +### Summary tab charts + +The charts displayed in the **Summary** tab give you a general idea of the overall status of your devices. The two charts displayed include: + +- **Overall security update status**: Gives you general insight into of the current update compliance state of your enrolled devices. For instance, if the chart shows a large number of devices are missing multiple security updates, it may indicate an issue in the software update process. + +- **Feature update status**: Gives you a general understanding of how many devices are eligible for feature updates based on the operating system lifecycle. + +:::image type="content" source="media/33771278-overall-security-update-status.png" alt-text="Screenshot of the charts in the workbook's summary tab" lightbox="media/33771278-overall-security-update-status.png"::: + +## Quality updates tab + +The **Quality updates** tab displays generalized data at the top by using tiles. The quality update data becomes more specific as you navigate lower in this tab. The top of the **Quality updates** tab contains tiles with the following information: + +- **Devices count**: Count of devices that have reported at least one security update is or was applicable and offered in the past 30 days, regardless of installation state of the update. +- **Latest security update**: Count of devices that have installed the latest security update. +- **Security update status**: Count of devices that haven't installed a security update released within the last 60 days. +- **Total alerts**: Count of active alerts that are for quality updates. + +Below the tiles, the **Quality updates** tab is subdivided into **Update status** and **Device status** groups. These different chart groups allow you to easily discover trends in compliance data. For instance, you may remember that about third of your devices were in the installing state yesterday, but this number didn't change as much as you were expecting. That unexpected trend may cause you to investigate and resolve a potential issue before end-users are impacted. + +### Update status group for quality updates + +The **Update status** group for quality updates contains the following items: + +- **Update states for all security releases**: Chart containing the number of devices in a specific state, such as installing, for security updates. +- **Update states for the latest security releases**: Chart containing the number of devices in a specific state for the most recent security update. +- **Update alerts for all security releases**: Chart containing the count of active errors and warnings for security updates. + +:::image type="content" source="media/33771278-update-deployment-status-table.png" alt-text="Screenshot of the charts and table in the workbook's quality updates tab" lightbox="media/33771278-update-deployment-status-table.png"::: + +The **Update deployment status** table displays the quality updates for each operating system version that were released within the last 60 days. For each update, drill-in further by selecting a value from the following columns: + +| Column name | Description | Drill-in description | +|---|---|---| +|**Alerts**| Number of different error codes encountered by devices for the update. | Selecting this number lists the alert name for each error code and a count of devices with the error. Select the device count to display a list of devices that have an active alert for the error code. +| **KB Number** | KB number for the update | Selecting the KB number will open the support information webpage for the update.| +| **Total devices** | Number of devices that have been offered the update, or are installing, have installed, or canceled the update. | Selecting the device count opens a device list table. This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial). | + +### Device status group for quality updates + +The **Device status** group for quality updates contains the following items: + +- **OS build number**: Chart containing a count of devices by OS build that are getting security updates. +- **Target version**: Chart containing how many devices by operating system version that are getting security updates. +- **Device compliance status**: Table containing a list of devices getting security updates and update installation information including active alerts for the devices. + - This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial). + +## Feature updates tab + +The **Feature updates** tab displays generalized data at the top by using tiles. The feature update data becomes more specific as you navigate lower in this tab. The top of the **Feature updates** tab contains tiles with the following information: + +- **Devices count**: Count of devices that have reported a feature update is or was applicable and offered in the past 30 days, regardless of installation state of the update. +- **Feature update status**: Count of the devices that installed a feature update in the past 30 days. +- **End Of Service**: Count of devices running an operating system version that no longer receives feature updates. For more information, see the [Windows lifecycle FAQ](/lifecycle/faq/windows). +- **Nearing EOS** Count of devices that are within 18 months of their end of service date. +- **Total alerts**: Count of active alerts that are for feature updates. + +Just like the [**Quality updates** tab](#quality-updates-tab), the **Feature updates** tab is also subdivided into **Update status** and **Device status** groups below the tiles. + +### Update status group for feature updates + +The **Update status** group for feature updates contains the following items: + +- **Target version**: Chart containing count of devices per targeted operating system version. +- **Safeguard holds**: Chart containing count of devices per operating system version that are under a safeguard hold for a feature update +- **Update alerts**: Chart containing the count of active errors and warnings for feature updates. + +**Update deployment status** table for feature updates displays the installation status by targeted operating system version. For each operating system version targeted the following columns are available: + +| Column name | Description | Drill-in description | +|---|---|---| +| **Total progress** | Percentage of devices that installed the targeted operating system version feature update within the last 30 days. | A bar graph is included in this column. Use the **Total devices** drill-in for additional information. | +|**Alerts**| Number of different error codes encountered by devices for the update. | Selecting this number lists the alert name for each error code and a count of devices with the error. Select the device count to display a list of devices that have an active alert for the error code. | +| **Total Devices** | Count of devices for each targeted operating system version that have been offered the update, or are installing, have installed, or canceled the feature update.| Selecting the device count opens a device list table. This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial). | + +### Device status group for feature updates + +The **Device status** group for feature updates contains the following items: + +- **Windows 11 readiness status**: Chart containing how many devices that have a status of capable, not capable, or unknown for Windows 11 readiness. +- **Device alerts**: Count of active alerts for feature updates in each alert classification. +- **Device compliance status**: Table containing a list of devices getting a feature update and installation information including active alerts for the devices. + - This table is limited to the first 250 rows. Select `...` to export the full list, or display the query in [Log Analytics](/azure/azure-monitor/logs/log-analytics-tutorial). + +## Customize the workbook + +Since the Update Compliance workbook is an [Azure Workbook template](/azure/azure-monitor/visualize/workbooks-templates), it can be customized to suit your needs. If you open a template, make some adjustments, and save it, the template is saved as a workbook. This workbook appears in green. The original template is left untouched. For more information about workbooks, see [Get started with Azure Workbooks](/azure/azure-monitor/visualize/workbooks-getting-started). + + +## Next steps + +- Explore the [Update Compliance (preview) schema](update-compliance-v2-schema.md) +- Review [Feedback, support, and troubleshooting](update-compliance-v2-help.md) information for Update Compliance diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md index 7ff238e112..36f12e46cd 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-unenroll-tenant.md @@ -33,14 +33,14 @@ Unenrolling from Windows Autopatch requires manual actions from both you and fro | Responsibility | Description | | ----- | ----- | | Windows Autopatch data | Windows Autopatch will delete user data that is within the Windows Autopatch service. We won’t make changes to any other data. For more information about how data is used in Windows Autopatch, see [Privacy](../references/windows-autopatch-privacy.md). | -| Deregistering devices | Windows Autopatch will deregister all devices previously registered with the service. Only the Windows Autopatch device record will be deleted. We will not delete Microsoft Intune and/or Azure Active Directory device records. For more information, see [Deregister a device](/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices). | +| Deregistering devices | Windows Autopatch will deregister all devices previously registered with the service. Only the Windows Autopatch device record will be deleted. We won't delete Microsoft Intune and/or Azure Active Directory device records. For more information, see [Deregister a device](/windows/deployment/windows-autopatch/operate/windows-autopatch-deregister-devices). | ## Your responsibilities after unenrolling your tenant | Responsibility | Description | | ----- | ----- | | Updates | After the Windows Autopatch service is unenrolled, we’ll no longer provide updates to your devices. You must ensure that your devices continue to receive updates through your own policies to ensure they're secure and up to date. | -| Optional Windows Autopatch configuration | Windows Autopatch won’t remove the configuration policies or groups used to enable updates on your devices. You're responsible for these policies following tenant unenrollment. If you don’t wish to use these policies for your devices after unenrollment, you may safely delete them. | +| Optional Windows Autopatch configuration | Windows Autopatch won’t remove the configuration policies or groups used to enable updates on your devices. You're responsible for these policies following tenant unenrollment. If you don’t wish to use these policies for your devices after unenrollment, you may safely delete them. For more information, see [Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md). | | Windows Autopatch cloud service accounts | After unenrollment, you may safely remove the cloud service accounts created during the enrollment process. The accounts are: | | Conditional access policy | After unenrollment, you may safely remove the **Modern Workplace – Secure Workstation** conditional access policy. | | Microsoft Endpoint Manager roles | After unenrollment, you may safely remove the Modern Workplace Intune Admin role. | diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index f983d739b8..024c53413c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -22,54 +22,61 @@ ms.technology: windows-sec **Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this signature, you'll either need a publicly issued code signing certificate or an internal CA. If you've purchased a code-signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md). +As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this signature, you'll either need a publicly issued code signing certificate or an internal CA. If you've purchased a code-signing certificate, you can skip this article and instead follow other articles listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md). -If you have an internal CA, complete these steps to create a code signing certificate. -Only RSA algorithm is supported for the code signing certificate, and signatures must be PKCS 1.5 padded. -ECDSA isn't supported. +If you have an internal CA, complete these steps to create a code signing certificate. -1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. +> [!WARNING] +> Boot failure (blue screen) may occur if your signing certificate does not follow these rules: +> +> - All policies, including base and supplemental, must be signed according to the [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652). +> - Use RSA SHA-256 only. ECDSA isn't supported. +> - Don't use UTF-8 encoding for certificate fields, like 'subject common name' and 'issuer common name'. These strings must be encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING. +> - Keys must be less than or equal to 4K key size +> -2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. +1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. + +2. When connected, right-click **Certificate Templates**, and then select **Manage** to open the Certification Templates Console. ![CA snap-in showing Certificate Templates.](images/dg-fig27-managecerttemp.png) Figure 1. Manage the certificate templates -3. In the navigation pane, right-click the Code Signing certificate, and then click **Duplicate Template**. +3. In the navigation pane, right-click the Code Signing certificate, and then select **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. -5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **WDAC Catalog Signing Certificate**. +5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **WDAC Catalog Signing Certificate**. -6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. +6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. -7. On the **Extensions** tab, select the **Basic Constraints** check box, and then click **Edit**. +7. On the **Extensions** tab, select the **Basic Constraints** check box, and then select **Edit**. -8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. +8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. ![Edit Basic Constraints Extension.](images/dg-fig29-enableconstraints.png) Figure 2. Select constraints on the new template -9. If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. +9. If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. 10. On the **Subject Name** tab, select **Supply in the request**. 11. On the **Security** tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate. -12. Click **OK** to create the template, and then close the Certificate Template Console. +12. Select **OK** to create the template, and then close the Certificate Template Console. When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps: -1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 3. +1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then select **Certificate Template to Issue**, as shown in Figure 3. ![Select Certificate Template to Issue.](images/dg-fig30-selectnewcert.png) @@ -77,38 +84,38 @@ When this certificate template has been created, you must publish it to the CA p A list of available templates to issue appears, including the template you created. -2. Select the WDAC Catalog signing certificate, and then click **OK**. +2. Select the WDAC Catalog signing certificate, and then select **OK**. Now that the template is available to be issued, you must request one from the computer running Windows 10 and Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: -1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. +1. In MMC, from the **File** menu, select **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. -2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then click **Request New Certificate**. +2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then select **Request New Certificate**. -3. Click **Next** twice to get to the certificate selection list. +3. Select **Next** twice to get to the certificate selection list. -4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. +4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. ![Request Certificates: more information required.](images/dg-fig31-getmoreinfo.png) Figure 4. Get more information for your code signing certificate -5. In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** +5. In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then select **Add**. When added, select **OK.** -6. Enroll and finish. +6. Enroll and finish. >[!NOTE] >If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. -This certificate must be installed in the user's personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file won't be required because it already exists in your personal store. If you're signing on another computer, you'll need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: +This certificate must be installed in the user's personal store on the computer that will be signing the catalog files and code integrity policies. If the signing will happen on the same computer you used to request the certificate, you can skip the following steps. If you'll be signing on another computer, you need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: -1. Right-click the certificate, point to **All Tasks**, and then click **Export**. +1. Right-click the certificate, point to **All Tasks**, and then select **Export**. -2. Click **Next**, and then select **Yes, export the private key**. +2. Select **Next**, and then select **Yes, export the private key**. -3. Choose the default settings, and then select **Export all extended properties**. +3. Choose the default settings, and then select **Export all extended properties**. -4. Set a password, select an export path, and then select **WDACCatSigningCert.pfx** as the file name. +4. Set a password, select an export path, and then select **WDACCatSigningCert.pfx** as the file name. When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. @@ -117,4 +124,3 @@ When the certificate has been exported, import it into the personal store for th - [Windows Defender Application Control](windows-defender-application-control.md) - [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) - diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 474a39e5dd..e1f7559c0d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -90,7 +90,7 @@ Each file rule level has its benefit and disadvantage. Use Table 2 to select the |----------- | ----------- | | **Hash** | Specifies individual [Authenticode/PE image hash values](#more-information-about-hashes) for each discovered binary. This level is the most specific level, and requires more effort to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | | **FileName** | Specifies the original filename for each binary. Although the hash values for an application are modified when updated, the file names are typically not. This level offers less specific security than the hash level, but it doesn't typically require a policy update when any binary is modified. | -| **FilePath** | Beginning with Windows 10 version 1903, this level allows binaries to run from specific file path locations. More information about FilePath level rules can be found below. | +| **FilePath** | Beginning with Windows 10 version 1903, this level allows binaries to run from specific file path locations. FilePath rules only apply to user mode binaries and can't be used to allow kernel mode drivers. More information about FilePath level rules can be found below. | | **SignedVersion** | This level combines the publisher rule with a version number. It allows anything to run from the specified publisher with a version at or above the specified version number. | | **Publisher** | This level combines the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. You can use this rule level to trust a certificate issued by a particular CA and issued to a specific company you trust (such as Intel, for device drivers). | | **FilePublisher** | This level combines the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. | diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index 3200f16f8f..07f86d0c75 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -11,10 +11,10 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: dansimp manager: dansimp -ms.date: 06/27/2022 +ms.date: 08/15/2022 ms.technology: windows-sec --- @@ -31,26 +31,29 @@ ms.technology: windows-sec Signed Windows Defender Application Control (WDAC) policies give organizations the highest level of malware protection available in Windows—must be signed with [PKCS #7](https://datatracker.ietf.org/doc/html/rfc5652). In addition to their enforced policy rules, signed policies can't be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this idea of the policies in mind, it's much more difficult to remove signed WDAC policies. SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies. -Before you sign with PKCS #7 and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run. +> [!WARNING] +> Boot failure (blue screen) may occur if your signing certificate does not follow these rules: +> +> - All policies, including base and supplemental, must be signed according to the [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652). +> - Use RSA SHA-256 only. ECDSA isn't supported. +> - Don't use UTF-8 encoding for certificate fields, like 'subject common name' and 'issuer common name'. These strings must be encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING. +> - Keys must be less than or equal to 4K key size +> + +Before you sign with PKCS #7 and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run. Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. -If you don't currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) to create one with your on-premises CA. +If you don't currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) to create one with your on-premises CA. Before PKCS #7-signing WDAC policies for the first time, ensure you enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath -Option 9`, even if you're not sure whether the option is already enabled. If so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Windows Defender Application Control policy rules](select-types-of-rules-to-create.md). To sign a Windows Defender Application Control policy with SignTool.exe, you need the following components: -- SignTool.exe, found in the [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk/) (Windows 7 or later) +- SignTool.exe, found in the [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk/) (Windows 7 or later) -- The binary format of the WDAC policy that you generated in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) or another WDAC policy that you've created - -- An internal CA code signing certificate or a purchased code signing certificate - -> [!NOTE] -> All policies (base and supplemental and single-policy format) must be pkcs7 signed. [PKCS 7 Standard](https://datatracker.ietf.org/doc/html/rfc5652) -> ->Certificate fields, like 'subject common name' and 'issuer common name,' cannot be UTF-8 encoded, otherwise, blue screens may occur. These strings must be encoded as PRINTABLE_STRING, IA5STRING or BMPSTRING. +- The binary format of the WDAC policy that you generated in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) or another WDAC policy that you've created +- An internal CA code signing certificate or a purchased code signing certificate If you don't have a code signing certificate, see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) for instructions on how to create one. If you use an alternate certificate or Windows Defender Application Control (WDAC) policy, ensure you update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing WDAC policy, copy each of the following commands into an elevated Windows PowerShell session: @@ -64,12 +67,12 @@ If you don't have a code signing certificate, see [Optional: Create a code signi > [!NOTE] > This example uses the WDAC policy that you created in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section. If you are signing another policy, be sure to update the **$CIPolicyPath** variable with the correct information. -2. Import the .pfx code signing certificate. Import the code signing certificate that you'll use to sign the WDAC policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). +2. Import the .pfx code signing certificate. Import the code signing certificate that you'll use to sign the WDAC policy into the user’s personal store on the computer where the signing happens. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). 3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. 4. Navigate to your desktop as the working directory: - + ```powershell cd $env:USERPROFILE\Desktop ``` @@ -104,11 +107,11 @@ If you don't have a code signing certificate, see [Optional: Create a code signi ```powershell sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin ``` - + > [!NOTE] > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy. 9. Validate the signed file. When complete, the commands should output a signed policy file called {PolicyID}.cip to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](deployment/deploy-windows-defender-application-control-policies-using-group-policy.md). > [!NOTE] -> The device with the signed policy must be rebooted one time with Secure Boot enabled for the UEFI lock to be set. +> The device with the signed policy must be rebooted one time with Secure Boot enabled for the UEFI lock to be set. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md index 0d8e2466d8..4256d0a041 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Application Control and .NET Hardening (Windows) -description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime. +title: Windows Defender Application Control and .NET (Windows) +description: Understand how WDAC and .NET work together and use Dynamic Code Security to verify code loaded by .NET at runtime. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -11,30 +11,43 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: dansimp manager: dansimp -ms.date: 06/15/2022 +ms.date: 08/10/2022 ms.technology: windows-sec --- -# Windows Defender Application Control and .NET hardening +# Windows Defender Application Control (WDAC) and .NET -Historically, Windows Defender Application Control (WDAC) has restricted the set of applications, libraries, and scripts that are allowed to run to those sets approved by an organization. -Security researchers have found that some .NET applications may be used to circumvent those controls by using .NET’s capabilities to load libraries from external sources or generate new code on the fly. -Beginning with Windows 10, version 1803, or Windows 11, Windows Defender Application Control features a new capability, called *Dynamic Code Security* to verify code loaded by .NET at runtime. +.NET apps (as written in a high-level language like C#) are compiled to an Intermediate Language (IL). IL is a compact code format that can be supported on any operating system or architecture. Most .NET apps use APIs that are supported in multiple environments, requiring only the .NET runtime to run. IL needs to be compiled to native code in order to execute on a CPU, for example Arm64 or x64. When .NET compiles IL to native image (NI) on a device with a WDAC user mode policy, it first checks whether the original IL file passes the current WDAC policies. If so, .NET sets an NTFS extended attribute (EA) on the generated NI file so that WDAC knows to trust it as well. When the .NET app runs, WDAC sees the EA on the NI file and allows it. + +The EA set on the NI file only applies to the currently active WDAC policies. If one of the active WDAC policies is updated or a new policy is applied, the EA on the NI file is invalidated. The next time the app runs, WDAC will block the NI file. .NET handles the block gracefully and will fall back to the original IL code. If the IL still passes the latest WDAC policies, then the app runs without any functional impact. Since the IL is now being compiled at runtime, you may notice a slight impact to performance of the app. When .NET must fall back to IL, .NET will also schedule a process to run at the next maintenance window to regenerate all NI files, thus reestablishing the WDAC EA for all code that passes the latest WDAC policies. + +In some cases, if an NI file is blocked, you may see a "false positive" block event in the *CodeIntegrity - Operational* event log as described in [WDAC Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues#net-native-images-may-generate-false-positive-block-events). + +To mitigate any performance impact caused when the WDAC EA isn't valid or missing, use any of the following strategies: + +1. Work with the app developer to pre-compile their NI and digitally sign it. Then, ensure your WDAC policies allow that signature; +2. Run *ngen.exe update* to force .NET to regenerate all NI files immediately after applying changes to your WDAC policies; +3. [Create and sign a catalog file](/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control) for the native images + +## WDAC and .NET hardening + +Security researchers have found that some .NET capabilities that allow apps to load libraries from external sources or generate new code at runtime can be used to circumvent WDAC controls. +Beginning with Windows 10, version 1803, WDAC includes a new option, called *Dynamic Code Security* that works with .NET to verify code loaded at runtime. When the Dynamic Code Security option is enabled, Application Control policy is applied to libraries that .NET loads from external sources. For example, any non-local sources, such as the internet or a network share. -Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that has been tampered with. +Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that has been tampered with. -Dynamic Code Security isn't enabled by default because existing policies may not account for externally loaded libraries. -Additionally, a few .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, aren't currently supported with Dynamic Code Security enabled. -Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. +Dynamic Code Security isn't enabled by default because existing policies may not account for externally loaded libraries. +Additionally, a few .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, aren't currently supported with Dynamic Code Security enabled. +Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. -Additionally, customers can precompile for deployment only to prevent an allowed executable from being terminated because it tries to load unsigned dynamically generated code. See the "Precompiling for Deployment Only" section in the [ASP.NET Precompilation Overview](/aspnet/web-forms/overview/older-versions-getting-started/deploying-web-site-projects/precompiling-your-website-cs) document for how to fix that. +Additionally, customers can precompile for deployment only to prevent an allowed executable from being terminated because it tries to load unsigned dynamically generated code. See the "Precompiling for Deployment Only" section in the [ASP.NET Precompilation Overview](/previous-versions/aspnet/bb398860(v=vs.100)) document for how to fix that. -To enable Dynamic Code Security, add the following option to the `` section of your policy: +To enable Dynamic Code Security, add the following option to the `` section of your WDAC policy: ```xml