mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-23 18:57:22 +00:00
Merge branch 'master' into privacy-update-vb
This commit is contained in:
Sinead O'Sullivan
commit
df1a18aa6a
@ -10,9 +10,7 @@ ms.prod: internet-explorer
|
||||
ms.technology:
|
||||
ms.topic: kb-support
|
||||
ms.custom: CI=111020
|
||||
ms.localizationpriority: Normal
|
||||
# localization_priority: medium
|
||||
# ms.translationtype: MT
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 01/23/2020
|
||||
---
|
||||
# Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros
|
||||
|
||||
@ -7,7 +7,8 @@
|
||||
"**/**.yml"
|
||||
],
|
||||
"exclude": [
|
||||
"**/obj/**"
|
||||
"**/obj/**",
|
||||
"**/includes/**"
|
||||
]
|
||||
}
|
||||
],
|
||||
@ -19,7 +20,8 @@
|
||||
"**/*.svg"
|
||||
],
|
||||
"exclude": [
|
||||
"**/obj/**"
|
||||
"**/obj/**",
|
||||
"**/includes/**"
|
||||
]
|
||||
}
|
||||
],
|
||||
|
||||
@ -21,6 +21,7 @@ This article lists new and updated articles for the Mobile Device Management (MD
|
||||
|New or updated article | Description|
|
||||
|--- | ---|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policy:<br>- [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) |
|
||||
| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:<br>-Properties/SleepMode |
|
||||
|
||||
## October 2020
|
||||
|
||||
|
||||
@ -27,6 +27,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
|New or updated article|Description|
|
||||
|-----|-----|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [Multitasking/BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) |
|
||||
| [SurfaceHub CSP](surfacehub-csp.md) | Added the following new node:<br>-Properties/SleepMode |
|
||||
| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:<br>- Settings/AllowWindowsDefenderApplicationGuard |
|
||||
|
||||
## What’s new in MDM for Windows 10, version 2004
|
||||
|
||||
@ -78,6 +78,9 @@ If you enable this policy setting, built-in system services hosted in svchost.ex
|
||||
|
||||
This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Enabling this policy could cause compatibility issues with third-party software that uses svchost.exe processes (for example, third-party antivirus software).
|
||||
|
||||
If you disable or do not configure this policy setting, the stricter security settings will not be applied.
|
||||
|
||||
<!--/Description-->
|
||||
@ -122,4 +125,3 @@ Footnotes:
|
||||
- 8 - Available in Windows 10, version 2004.
|
||||
|
||||
<!--/Policies-->
|
||||
|
||||
|
||||
@ -160,7 +160,7 @@ You can view System Information to check that Windows Defender Credential Guard
|
||||
|
||||
2. Click **System Summary**.
|
||||
|
||||
3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Configured**.
|
||||
3. Confirm that **Credential Guard** is shown next to **Virtualization-based security Services Running**.
|
||||
|
||||
Here's an example:
|
||||
|
||||
|
||||
@ -62,7 +62,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B
|
||||
The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/).
|
||||
> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://social.technet.microsoft.com/Forums/en-US/eac2cc67-8442-42db-abad-2ed173879751/bitlocker-without-tpm?forum=win10itprosetup).
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -141,6 +141,7 @@ The information below list the proxy and firewall configuration information requ
|
||||
|*.ods.opinsights.azure.com |Port 443 |Outbound|Yes |
|
||||
|*.oms.opinsights.azure.com |Port 443 |Outbound|Yes |
|
||||
|*.blob.core.windows.net |Port 443 |Outbound|Yes |
|
||||
|*.azure-automation.net |Port 443 |Outbound|Yes |
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -249,12 +249,14 @@ To offboard the Windows server, you can use either of the following methods:
|
||||
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
```powershell
|
||||
$ErrorActionPreference = "SilentlyContinue"
|
||||
# Load agent scripting object
|
||||
$AgentCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg
|
||||
# Remove OMS Workspace
|
||||
$AgentCfg.RemoveCloudWorkspace($WorkspaceID)
|
||||
$AgentCfg.RemoveCloudWorkspace("WorkspaceID")
|
||||
# Reload the configuration and apply changes
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
|
||||
```
|
||||
## Related topics
|
||||
- [Onboard Windows 10 devices](configure-endpoints.md)
|
||||
|
||||
@ -10,7 +10,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.reviewer:
|
||||
ms.reviewer: ksarens
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
@ -54,8 +54,8 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au
|
||||
3. Go to **Program settings** and choose the app you want to apply mitigations to. <br/>
|
||||
- If the app you want to configure is already listed, click it and then click **Edit**.
|
||||
- If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app. <br/>
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You are notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
@ -70,12 +70,12 @@ You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Au
|
||||
|
||||
If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work:
|
||||
|
||||
Enabled in **Program settings** | Enabled in **System settings** | Behavior
|
||||
-|-|-
|
||||
[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings**
|
||||
[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings**
|
||||
[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings**
|
||||
[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option
|
||||
|Enabled in **Program settings** | Enabled in **System settings** | Behavior |
|
||||
|:---|:---|:---|
|
||||
|[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** |
|
||||
|[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** |
|
||||
|[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** |
|
||||
|[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option |
|
||||
|
||||
### Example 1: Mikael configures Data Execution Prevention in system settings section to be off by default
|
||||
|
||||
@ -98,8 +98,8 @@ The result will be that DEP will be enabled for *test.exe*. DEP will not be enab
|
||||
3. Go to **Program settings** and choose the app you want to apply mitigations to.<br/>
|
||||
- If the app you want to configure is already listed, click it and then click **Edit**.
|
||||
- If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app.<br/>
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
- Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location.
|
||||
- Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want.
|
||||
|
||||
4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows.
|
||||
|
||||
@ -209,41 +209,41 @@ Set-Processmitigation -Name test.exe -Remove -Disable DEP
|
||||
|
||||
This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation.
|
||||
|
||||
Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet
|
||||
- | - | - | -
|
||||
Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available
|
||||
Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available
|
||||
Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available
|
||||
Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available
|
||||
Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available
|
||||
Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available
|
||||
Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode
|
||||
Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad
|
||||
Block remote images | App-level only | BlockRemoteImages | Audit not available
|
||||
Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly
|
||||
Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned
|
||||
Disable extension points | App-level only | ExtensionPoint | Audit not available
|
||||
Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall
|
||||
Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess
|
||||
Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available
|
||||
Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available
|
||||
Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available
|
||||
Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available
|
||||
Validate handle usage | App-level only | StrictHandle | Audit not available
|
||||
Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available
|
||||
Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available
|
||||
|Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet |
|
||||
|:---|:---|:---|:---|
|
||||
|Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available |
|
||||
|Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available |
|
||||
|Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available |
|
||||
|Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available
|
||||
|Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available
|
||||
|Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available
|
||||
|Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode
|
||||
|Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad
|
||||
|Block remote images | App-level only | BlockRemoteImages | Audit not available
|
||||
|Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly
|
||||
|Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned
|
||||
|Disable extension points | App-level only | ExtensionPoint | Audit not available
|
||||
|Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall
|
||||
|Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess
|
||||
|Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter <a href="#r1" id="t1">\[1\]</a> | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
||Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|Validate handle usage | App-level only | StrictHandle | Audit not available |
|
||||
|Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available |
|
||||
|Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available<a href="#r2" id="t2">\[2\]</a> |
|
||||
|
||||
<a href="#t1" id="r1">\[1\]</a>: Use the following format to enable EAF modules for DLLs for a process:
|
||||
|
||||
```PowerShell
|
||||
Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll
|
||||
```
|
||||
|
||||
<a href="#t2" id="r2">\[2\]</a>: Audit for this mitigation is not available via Powershell cmdlets.
|
||||
## Customize the notification
|
||||
|
||||
See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file.
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
|
||||
* [Evaluate exploit protection](evaluate-exploit-protection.md)
|
||||
* [Configure and audit exploit protection mitigations](customize-exploit-protection.md)
|
||||
|
||||
@ -50,18 +50,30 @@ This page explains how to create an AAD application, get an access token to Micr
|
||||
|
||||
## Create an app
|
||||
|
||||
1. Log on to [Azure](https://portal.azure.com) with user that has **Global Administrator** role.
|
||||
1. Log on to [Azure](https://portal.azure.com) with a user account that has the **Global Administrator** role.
|
||||
|
||||
2. Navigate to **Azure Active Directory** > **App registrations** > **New registration**.
|
||||
|
||||
|
||||
|
||||
3. In the registration from, enter the following information then select **Register**.
|
||||
3. When the **Register an application** page appears, enter your application's registration information:
|
||||
|
||||
|
||||
- **Name** - Enter a meaningful application name that will be displayed to users of the app.
|
||||
- **Supported account types** - Select which accounts you would like your application to support.
|
||||
|
||||
- **Name:** -Your application name-
|
||||
- **Application type:** Public client
|
||||
| Supported account types | Description |
|
||||
|-------------------------|-------------|
|
||||
| **Accounts in this organizational directory only** | Select this option if you're building a line-of-business (LOB) application. This option is not available if you're not registering the application in a directory.<br><br>This option maps to Azure AD only single-tenant.<br><br>This is the default option unless you're registering the app outside of a directory. In cases where the app is registered outside of a directory, the default is Azure AD multi-tenant and personal Microsoft accounts. |
|
||||
| **Accounts in any organizational directory** | Select this option if you would like to target all business and educational customers.<br><br>This option maps to an Azure AD only multi-tenant.<br><br>If you registered the app as Azure AD only single-tenant, you can update it to be Azure AD multi-tenant and back to single-tenant through the **Authentication** blade. |
|
||||
| **Accounts in any organizational directory and personal Microsoft accounts** | Select this option to target the widest set of customers.<br><br>This option maps to Azure AD multi-tenant and personal Microsoft accounts.<br><br>If you registered the app as Azure AD multi-tenant and personal Microsoft accounts, you cannot change this in the UI. Instead, you must use the application manifest editor to change the supported account types. |
|
||||
|
||||
- **Redirect URI (optional)** - Select the type of app you're building, **Web** or **Public client (mobile & desktop)**, and then enter the redirect URI (or reply URL) for your application.
|
||||
- For web applications, provide the base URL of your app. For example, `http://localhost:31544` might be the URL for a web app running on your local machine. Users would use this URL to sign in to a web client application.
|
||||
- For public client applications, provide the URI used by Azure AD to return token responses. Enter a value specific to your application, such as `myapp://auth`.
|
||||
|
||||
To see specific examples for web applications or native applications, check out our [quickstarts](/azure/active-directory/develop/#quickstarts).
|
||||
|
||||
When finished, select **Register**.
|
||||
|
||||
4. Allow your Application to access Microsoft Defender for Endpoint and assign it 'Read alerts' permission:
|
||||
|
||||
|
||||
@ -58,6 +58,9 @@ Wildcard | Description | Example | Matches | Does not match
|
||||
\* | Matches any number of any characters including none (note that when this wildcard is used inside a path it will substitute only one folder) | `/var/*/*.log` | `/var/log/system.log` | `/var/log/nested/system.log`
|
||||
? | Matches any single character | `file?.log` | `file1.log`<br/>`file2.log` | `file123.log`
|
||||
|
||||
>[!NOTE]
|
||||
>The product attempts to resolve firmlinks when evaluating exclusions. Firmlink resolution does not work when the exclusion contains wildcards or the target file (on the `Data` volume) does not exist.
|
||||
|
||||
## How to configure the list of exclusions
|
||||
|
||||
### From the management console
|
||||
|
||||
@ -23,6 +23,9 @@ ms.topic: conceptual
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On macOS 11 (Big Sur), Microsoft Defender for Endpoint requires additional configuration profiles. If you are an existing customer upgrading from earlier versions of macOS, make sure to deploy the additional configuration profiles listed on [this page](mac-sysext-policies.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Extensive testing of MDE (Microsoft Defender for Endpoint) with new system extensions on macOS 11 (Big Sur) revealed an intermittent issue that impacts macOS devices with specific graphic cards models. In rare cases on impacted macOS devices calls into macOS system extensions were seen resulting in kernel panic. Microsoft is actively working with Apple engineering to clarify profile of impacted devices and to address this macOS issue. In the meantime, if you encounter such a kernel panic, please submit a feedback report to Apple through the Feedback Assistant app.
|
||||
|
||||
|
||||
@ -65,6 +65,9 @@ There are several methods and deployment tools that you can use to install and c
|
||||
|
||||
The three most recent major releases of macOS are supported.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On macOS 11 (Big Sur), Microsoft Defender for Endpoint requires additional configuration profiles. If you are an existing customer upgrading from earlier versions of macOS, make sure to deploy the additional configuration profiles listed on [this page](mac-sysext-policies.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Extensive testing of MDE (Microsoft Defender for Endpoint) with new system extensions on macOS 11 (Big Sur) revealed an intermittent issue that impacts macOS devices with specific graphic cards models. In rare cases on impacted macOS devices calls into macOS system extensions were seen resulting in kernel panic. Microsoft is actively working with Apple engineering to clarify profile of impacted devices and to address this macOS issue. In the meantime, if you encounter such a kernel panic, please submit a feedback report to Apple through the Feedback Assistant app.
|
||||
|
||||
|
||||
@ -44,11 +44,13 @@ See [Use Intune to remediate vulnerabilities identified by Microsoft Defender fo
|
||||
|
||||
2. Select a security recommendation you would like to request remediation for, and then select **Remediation options**.
|
||||
|
||||
3. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices.
|
||||
3. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. If you choose the "attention required" remediation option, selecting a due date will not be available since there is no specific action.
|
||||
|
||||
4. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment.
|
||||
4. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices.
|
||||
|
||||
5. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request.
|
||||
5. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment.
|
||||
|
||||
6. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request.
|
||||
|
||||
If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender for Endpoint](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details.
|
||||
|
||||
@ -63,6 +65,8 @@ Lower your organization's exposure from vulnerabilities and increase your securi
|
||||
|
||||
When you submit a remediation request from the Security recommendations page, it kicks-off a remediation activity. A security task is created that can be tracked in the threat and vulnerability management **Remediation** page, and a remediation ticket is created in Microsoft Intune.
|
||||
|
||||
If you chose the "attention required" remediation option, there will be no progress bar, ticket status, or due date since there is no actual action we can monitor.
|
||||
|
||||
Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete.
|
||||
|
||||
|
||||
|
||||
@ -95,7 +95,7 @@ From the flyout, you can choose any of the following options:
|
||||
|
||||
- **Open software page** - Open the software page to get more context on the software and how it's distributed. The information can include threat context, associated recommendations, weaknesses discovered, number of exposed devices, discovered vulnerabilities, names and detailed of devices with the software installed, and version distribution.
|
||||
|
||||
- [**Remediation options**](tvm-remediation.md) - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address.
|
||||
- [**Remediation options**](tvm-remediation.md) - Submit a remediation request to open a ticket in Microsoft Intune for your IT administrator to pick up and address. Track the remediation activity in the Remediation page.
|
||||
|
||||
- [**Exception options**](tvm-exception.md) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue yet.
|
||||
|
||||
|
||||
@ -57,7 +57,7 @@ Select the software that you want to investigate. A flyout panel will open with
|
||||
|
||||
### Software that isn't supported
|
||||
|
||||
Software that isn't currently supported by threat & vulnerability management is still present in the Software inventory page. Because it is not supported, only limited data will be available. Filter by unsupported software with the "Not available" option in the "Weakness" section.
|
||||
Software that isn't currently supported by threat & vulnerability management may be present in the Software inventory page. Because it is not supported, only limited data will be available. Filter by unsupported software with the "Not available" option in the "Weakness" section.
|
||||
|
||||
|
||||
|
||||
@ -66,6 +66,7 @@ The following indicates that a software is not supported:
|
||||
- Weaknesses field shows "Not available"
|
||||
- Exposed devices field shows a dash
|
||||
- Informational text added in side panel and in software page
|
||||
- The software page won't have the security recommendations, discovered vulnerabilities, or event timeline sections
|
||||
|
||||
Currently, products without a CPE are not shown in the software inventory page, only in the device level software inventory.
|
||||
|
||||
|
||||
@ -84,10 +84,14 @@ Go to the security recommendation page and select a recommendation with a zero-d
|
||||
|
||||
There will be a link to mitigation options and workarounds if they are available. Workarounds may help reduce the risk posed by this zero-day vulnerability until a patch or security update can be deployed.
|
||||
|
||||
Open remediation options and choose the attention type. An "attention required" remediation option is recommended for the zero-day vulnerabilities, since an update hasn't been released yet. If there are older vulnerabilities for this software you wish to remediation, you can override the "attention required" remediation option and choose “update.”
|
||||
Open remediation options and choose the attention type. An "attention required" remediation option is recommended for the zero-day vulnerabilities, since an update hasn't been released yet. You won't be able to select a due date, since there is no specific action to perform. If there are older vulnerabilities for this software you wish to remediation, you can override the "attention required" remediation option and choose “update.”
|
||||
|
||||
|
||||
|
||||
## Track zero-day remediation activities
|
||||
|
||||
Go to the threat and vulnerability management [Remediation](tvm-remediation.md) page to view the remediation activity item. If you chose the "attention required" remediation option, there will be no progress bar, ticket status, or due date since there is no actual action we can monitor. You can filter by remediation type, such as "software update" or "attention required," to see all activity items in the same category.
|
||||
|
||||
## Patching zero-day vulnerabilities
|
||||
|
||||
When a patch is released for the zero-day, the recommendation will be changed to “Update” and a blue label next to it that says “New security update for zero day.” It will no longer consider as a zero-day, the zero-day tag will be removed from all pages.
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 09/16/2020
|
||||
ms.date: 11/13/2020
|
||||
---
|
||||
|
||||
# Use multiple Windows Defender Application Control Policies
|
||||
@ -27,7 +27,7 @@ ms.date: 09/16/2020
|
||||
The restriction of only having a single code integrity policy active on a system at any given time has felt limiting for customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios:
|
||||
|
||||
1. Enforce and Audit Side-by-Side
|
||||
- To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side-by-side with an existing enforcement-mode base policy
|
||||
- To validate policy changes before deploying in enforcement mode, users can now deploy an audit-mode base policy side by side with an existing enforcement-mode base policy
|
||||
2. Multiple Base Policies
|
||||
- Users can enforce two or more base policies simultaneously in order to allow simpler policy targeting for policies with different scope/intent
|
||||
- If two base policies exist on a device, an application has to be allowed by both to run
|
||||
@ -48,19 +48,19 @@ The restriction of only having a single code integrity policy active on a system
|
||||
|
||||
## Creating WDAC policies in Multiple Policy Format
|
||||
|
||||
In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format.
|
||||
In order to allow multiple policies to exist and take effect on a single system, policies must be created using the new Multiple Policy Format. The "MultiplePolicyFormat" switch in [New-CIPolicy](https://docs.microsoft.com/powershell/module/configci/new-cipolicy?view=win10-ps&preserve-view=true) results in 1) random GUIDs being generated for the policy ID and 2) the policy type being specified as base. The below is an example of creating a new policy in the multiple policy format.
|
||||
|
||||
```powershell
|
||||
New-CIPolicy -MultiplePolicyFormat -ScanPath "<path>" -UserPEs -FilePath ".\policy.xml" -Level Publisher -Fallback Hash
|
||||
```
|
||||
|
||||
Optionally, you can choose to make the new base policy supplementable (allow supplemental policies).
|
||||
Optionally, you can choose to make the new base policy allow for supplemental policies.
|
||||
|
||||
```powershell
|
||||
Set-RuleOption -FilePath <string> -Option 17
|
||||
```
|
||||
|
||||
For signed base policies that are being made supplementable, you need to ensure that supplemental signers are defined. Use the "Supplemental" switch in Add-SignerRule to provide supplemental signers.
|
||||
For signed base policies to allow for supplemental policies, make sure that supplemental signers are defined. Use the **Supplemental** switch in **Add-SignerRule** to provide supplemental signers.
|
||||
|
||||
```powershell
|
||||
Add-SignerRule -FilePath <string> -CertificatePath <string> [-Kernel] [-User] [-Update] [-Supplemental] [-Deny] [<CommonParameters>]
|
||||
@ -77,7 +77,8 @@ In order to create a supplemental policy, begin by creating a new policy in the
|
||||
Set-CIPolicyIdInfo [-FilePath] <string> [-PolicyName <string>] [-SupplementsBasePolicyID <guid>] [-BasePolicyToSupplementPath <string>] [-ResetPolicyID] [-PolicyId <string>] [<CommonParameters>]
|
||||
```
|
||||
|
||||
Note that "ResetPolicyId" reverts a supplemental policy to a base policy, and resets the policy GUIDs back to a random GUID.
|
||||
> [!NOTE]
|
||||
> **ResetPolicyId** reverts a supplemental policy to a base policy, and resets the policy GUIDs back to a random GUID.
|
||||
|
||||
### Merging policies
|
||||
|
||||
@ -85,19 +86,21 @@ When merging, the policy type and ID of the leftmost/first policy specified is u
|
||||
|
||||
## Deploying multiple policies
|
||||
|
||||
In order to deploy multiple WDAC policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by MEM Intune's Custom OMA-URI feature. You cannot use the "Deploy Windows Defender Application Control" group policy setting to deploy multiple CI policies.
|
||||
In order to deploy multiple WDAC policies, you must either deploy them locally by copying the `*.cip` policy files into the proper folder or by using the ApplicationControl CSP, which is supported by MEM Intune's Custom OMA-URI feature.
|
||||
|
||||
### Deploying multiple policies locally
|
||||
|
||||
In order to deploy policies locally using the new multiple policy format you will need to:
|
||||
To deploy policies locally using the new multiple policy format, follow these steps:
|
||||
|
||||
1. Ensure policies are copied to the right location
|
||||
- Policies must be copied to this directory: C:\Windows\System32\CodeIntegrity\CiPolicies\Active
|
||||
2. Binary policy files must have the correct name which takes the format {PolicyGUID}.cip
|
||||
- Ensure that the name of the binary policy file is exactly the same as the PolicyID in the policy
|
||||
- For example, if the policy XML had the ID as `<PolicyID>{A6D7FBBF-9F6B-4072-BF37-693741E1D745}</PolicyID>` then the correct name for the binary policy file would be {A6D7FBBF-9F6B-4072-BF37-693741E1D745}.cip
|
||||
3. Reboot the system
|
||||
1. Ensure binary policy files have the correct naming format of `{PolicyGUID}.cip`.
|
||||
- Ensure that the name of the binary policy file is exactly the same as the PolicyID GUID in the policy
|
||||
- For example, if the policy XML had the ID as `<PolicyID>{A6D7FBBF-9F6B-4072-BF37-693741E1D745}</PolicyID>`, then the correct name for the binary policy file would be `{A6D7FBBF-9F6B-4072-BF37-693741E1D745}.cip`.
|
||||
2. Copy binary policies to `C:\Windows\System32\CodeIntegrity\CiPolicies\Active`.
|
||||
3. Reboot the system.
|
||||
|
||||
### Deploying multiple policies via ApplicationControl CSP
|
||||
|
||||
Multiple WDAC policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment. Refer to [ApplicationControl CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) for more information on deploying multiple policies, optionally using MEM Intune's Custom OMA-URI capability.
|
||||
Multiple WDAC policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment. See [ApplicationControl CSP](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp) for more information on deploying multiple policies, optionally using MEM Intune's Custom OMA-URI capability.
|
||||
|
||||
> [!NOTE]
|
||||
> WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](https://docs.microsoft.com/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format WDAC policies.
|
||||
|
||||
@ -88,6 +88,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
|
||||
|Lasse Trolle Borup | Langkjaer Cyber Defence |
|
||||
|Jimmy Bayne | @bohops |
|
||||
|Philip Tsukerman | @PhilipTsukerman |
|
||||
|Brock Mammen| |
|
||||
|
||||
<br />
|
||||
|
||||
@ -158,6 +159,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor
|
||||
<Deny ID="ID_DENY_KILL" FriendlyName="kill.exe" FileName="kill.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_LXRUN" FriendlyName="lxrun.exe" FileName="lxrun.exe" MinimumFileVersion="65535.65535.65535.65535"/>
|
||||
<Deny ID="ID_DENY_LXSS" FriendlyName="LxssManager.dll" FileName="LxssManager.dll" MinimumFileVersion="65535.65535.65535.65535"/>
|
||||
<Deny ID="ID_DENY_MFC40" FriendlyName="mfc40.dll" FileName="mfc40.dll" MinimumFileVersion="65535.65535.65535.65535"/>
|
||||
<Deny ID="ID_DENY_MS_BUILD" FriendlyName="Microsoft.Build.dll" FileName="Microsoft.Build.dll" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_MS_BUILD_FMWK" FriendlyName="Microsoft.Build.Framework.dll" FileName="Microsoft.Build.Framework.dll" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
<Deny ID="ID_DENY_MWFC" FriendlyName="Microsoft.Workflow.Compiler.exe" FileName="Microsoft.Workflow.Compiler.exe" MinimumFileVersion="65535.65535.65535.65535" />
|
||||
@ -896,6 +898,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor
|
||||
<FileRuleRef RuleID="ID_DENY_KILL"/>
|
||||
<FileRuleRef RuleID="ID_DENY_LXSS"/>
|
||||
<FileRuleRef RuleID="ID_DENY_LXRUN"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MFC40"/>
|
||||
<FileRuleRef RuleID="ID_DENY_MS_BUILD" />
|
||||
<FileRuleRef RuleID="ID_DENY_MS_BUILD_FMWK" />
|
||||
<FileRuleRef RuleID="ID_DENY_MWFC" />
|
||||
|
||||
@ -33,17 +33,17 @@ As of Windows 10, version 1703, you can use WDAC policies not only to control ap
|
||||
|
||||
To work with these options, the typical method is to create a policy that only affects plug-ins, add-ins, and modules, then merge it into your 'master' policy (merging is described in the next section).
|
||||
|
||||
For example, to create a WDAC policy that allows **addin1.dll** and **addin2.dll** to run in **ERP1.exe**, your organization's enterprise resource planning (ERP) application, run the following commands. Note that in the second command, **+=** is used to add a second rule to the **$rule** variable:
|
||||
For example, to create a WDAC policy allowing **addin1.dll** and **addin2.dll** to run in **ERP1.exe**, your organization's enterprise resource planning (ERP) application, run the following commands. Note that in the second command, **+=** is used to add a second rule to the **$rule** variable:
|
||||
|
||||
```powershell
|
||||
$rule = New-CIPolicyRule -DriverFilePath '.\ERP1.exe' -Level FileName -AppID '.\temp\addin1.dll'
|
||||
$rule += New-CIPolicyRule -DriverFilePath '.\ERP1.exe' -Level FileName -AppID '.\temp\addin2.dll'
|
||||
$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin1.dll' -Level FileName -AppID '.\ERP1.exe'
|
||||
$rule += New-CIPolicyRule -DriverFilePath '.\temp\addin1.dll' -Level FileName -AppID '.\ERP1.exe'
|
||||
New-CIPolicy -Rules $rule -FilePath ".\AllowERPAddins.xml" -UserPEs
|
||||
```
|
||||
|
||||
As another example, to create a WDAC policy that blocks **addin3.dll** from running in Microsoft Word, run the following command. You must include the `-Deny` option to block the specified add-ins in the specified application:
|
||||
|
||||
```powershell
|
||||
$rule = New-CIPolicyRule -DriverFilePath '.\winword.exe' -Level FileName -Deny -AppID '.\temp\addin3.dll'
|
||||
$rule = New-CIPolicyRule -DriverFilePath '.\temp\addin3.dll' -Level FileName -Deny -AppID '.\winword.exe'
|
||||
New-CIPolicy -Rules $rule -FilePath ".\BlockAddins.xml" -UserPEs
|
||||
```
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user