mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
create stand alone topic for vdi
This commit is contained in:
Joey Caparas
parent
8b3d300b4c
commit
d9848c128d
@ -12,6 +12,7 @@
|
||||
##### [Configure endpoints using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure endpoints using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune)
|
||||
##### [Configure endpoints using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure proxy and Internet settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -49,61 +49,6 @@ ms.localizationpriority: high
|
||||
|
||||
9. Click **OK** and close any open GPMC windows.
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
Windows Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
|
||||
|
||||
- Instant early onboarding of a short living session
|
||||
- A session should be onboarded to Windows Defender ATP prior to the actual provisioning
|
||||
|
||||
- Machine name persistence
|
||||
- The machine names are typically reused for new sessions. One may ask to have them as a single machine entry while others may prefer to have multiple entries per machine name.
|
||||
|
||||
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
|
||||
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
|
||||
|
||||
b. Select **VDI onboarding scripts for non-persistent endpoints** then click **Download package** and save the .zip file.
|
||||
|
||||
2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
3. The following step is only applicable if you're implementing a single entry for each machine: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
a. From the `WindowsDefenderATPOnboardingPackage`, copy the `Onboard-NonPersistentMachine.ps1` file to `golden/master` image to the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. <br>
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
4. Open a Local Group Policy Editor window and navigate to **Computer Configuration** > **Windows Settings** > **Scripts** > **Startup**.
|
||||
|
||||
5. Depending on the method you'd like to implement, follow the appropriate steps: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
Select the **PowerShell Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to onboarding PowerShell script `Onboard-NonPersistentMachine.ps1`. <br><br>
|
||||
**For multiple entries for each machine**:<br>
|
||||
Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
6. Test your solution:
|
||||
|
||||
a. Create a pool with one machine.
|
||||
|
||||
b. Logon to machine.
|
||||
|
||||
c. Logoff from machine.
|
||||
|
||||
d. Logon to machine with another user.
|
||||
|
||||
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Additional Windows Defender ATP configuration settings
|
||||
For each endpoint, you can state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
|
||||
@ -206,4 +151,5 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -203,4 +203,5 @@ Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/W
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -169,4 +169,5 @@ For more information about System Center Configuration Manager Compliance see [C
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -121,4 +121,5 @@ Monitoring can also be done directly on the portal, or by using the different de
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: Configure non-persistent virtual desktop infrastructure (VDI) machines in Windows Defender ATP
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, vdi
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
---
|
||||
|
||||
# Configure non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI)
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
Windows Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
|
||||
|
||||
- Instant early onboarding of a short living session
|
||||
- A session should be onboarded to Windows Defender ATP prior to the actual provisioning
|
||||
|
||||
- Machine name persistence
|
||||
- The machine names are typically reused for new sessions. One may ask to have them as a single machine entry while others may prefer to have multiple entries per machine name.
|
||||
|
||||
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
|
||||
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
|
||||
|
||||
b. Select **VDI onboarding scripts for non-persistent endpoints** then click **Download package** and save the .zip file.
|
||||
|
||||
2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
3. The following step is only applicable if you're implementing a single entry for each machine: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
a. From the `WindowsDefenderATPOnboardingPackage`, copy the `Onboard-NonPersistentMachine.ps1` file to `golden/master` image to the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. <br>
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
4. Open a Local Group Policy Editor window and navigate to **Computer Configuration** > **Windows Settings** > **Scripts** > **Startup**.
|
||||
|
||||
5. Depending on the method you'd like to implement, follow the appropriate steps: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
Select the **PowerShell Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to onboarding PowerShell script `Onboard-NonPersistentMachine.ps1`. <br><br>
|
||||
**For multiple entries for each machine**:<br>
|
||||
Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
6. Test your solution:
|
||||
|
||||
a. Create a pool with one machine.
|
||||
|
||||
b. Logon to machine.
|
||||
|
||||
c. Logoff from machine.
|
||||
|
||||
d. Logon to machine with another user.
|
||||
|
||||
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user