mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-07 18:17:22 +00:00
Merge pull request #2671 from MicrosoftDocs/master
"May the 4th be with You" Publish 5/4/2020 10:36 AM PST
This commit is contained in:
Thomas Raya
GitHub
commit
df35a73d9e
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get offline license
|
||||
description: The Get offline license operation retrieves the offline license information of a product from the Micosoft Store for Business.
|
||||
description: The Get offline license operation retrieves the offline license information of a product from the Microsoft Store for Business.
|
||||
ms.assetid: 08DAD813-CF4D-42D6-A783-994A03AEE051
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -14,7 +14,7 @@ ms.date: 09/18/2017
|
||||
|
||||
# Get offline license
|
||||
|
||||
The **Get offline license** operation retrieves the offline license information of a product from the Micosoft Store for Business.
|
||||
The **Get offline license** operation retrieves the offline license information of a product from the Microsoft Store for Business.
|
||||
|
||||
## Request
|
||||
|
||||
|
||||
@ -48,16 +48,16 @@ Supported operation is Exec.
|
||||
Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command.
|
||||
|
||||
<a href="" id="automaticredeployment"></a>**AutomaticRedeployment**
|
||||
Added in Windows 10, next major update. Node for the Autopilot Reset operation.
|
||||
Added in Windows 10, version 1809. Node for the Autopilot Reset operation.
|
||||
|
||||
<a href="" id="doautomaticredeployment"></a>**AutomaticRedeployment/doAutomaticRedeployment**
|
||||
Added in Windows 10, next major update. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard.
|
||||
Added in Windows 10, version 1809. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard.
|
||||
|
||||
<a href="" id="lasterror"></a>**AutomaticRedeployment/LastError**
|
||||
Added in Windows 10, next major update. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT).
|
||||
Added in Windows 10, version 1809. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT).
|
||||
|
||||
<a href="" id="status"></a>**AutomaticRedeployment/Status**
|
||||
Added in Windows 10, next major update. Status value indicating current state of an Autopilot Reset operation.
|
||||
Added in Windows 10, version 1809. Status value indicating current state of an Autopilot Reset operation.
|
||||
|
||||
Supported values:
|
||||
|
||||
|
||||
@ -113,7 +113,7 @@ To verify the BCD entries:
|
||||
2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder.
|
||||
|
||||
> [!NOTE]
|
||||
>If the computer is UEFI-based, the **bootmgr** and **winload** entires under **{default}** will contain an **.efi** extension.
|
||||
> If the computer is UEFI-based, the **bootmgr** and **winload** entries under **{default}** will contain an **.efi** extension.
|
||||
|
||||
|
||||
|
||||
@ -279,4 +279,3 @@ The reason that these entries may affect us is because there may be an entry in
|
||||
* `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows`
|
||||
|
||||
|
||||
|
||||
|
||||
@ -45,6 +45,7 @@ This section lists the error codes for Microsoft Windows Update.
|
||||
| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. |
|
||||
| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. |
|
||||
| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. |
|
||||
| 0x8024043D | `WU_E_SERVICEPROP_NOTAVAIL` | The requested service property is not available. |
|
||||
|
||||
## Inventory errors
|
||||
|
||||
|
||||
@ -19,8 +19,7 @@ Deploying feature or quality updates for many organizations is only part of the
|
||||
The compliance options have changed for devices on Windows 10, version 1709 and above:
|
||||
|
||||
- [For Windows 10, version 1709 and above](#for-windows-10-version-1709-and-above)
|
||||
- [For prior to Windows 10, version 1709](#prior-to-windows-10-version-1709)
|
||||
|
||||
- [Prior to Windows 10, version 1709](#prior-to-windows-10-version-1709)
|
||||
|
||||
## For Windows 10, version 1709 and above
|
||||
|
||||
@ -37,23 +36,19 @@ The policy also includes a configurable grace period to allow, for example, user
|
||||
|
||||
Further, the policy includes the option to opt out of automatic restarts until the deadline is reached by presenting the "engaged restart experience" until the deadline has actually expired. At this point the device will automatically schedule a restart regardless of active hours.
|
||||
|
||||
|
||||
|
||||
### Policy setting overview
|
||||
|
||||
|Policy|Description |
|
||||
|-|-|
|
||||
| (For Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. |
|
||||
|
||||
|
||||
| (Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. |
|
||||
|
||||
### Suggested configurations
|
||||
|
||||
|Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days|
|
||||
|-|-|-|-|-|
|
||||
|(For Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 |
|
||||
|(Windows 10, version 1709 and above) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 |
|
||||
|
||||
When **Specify deadlines for automatic updates and restarts** is set (For Windows 10, version 1709 and above):
|
||||
When **Specify deadlines for automatic updates and restarts** is set (Windows 10, version 1709 and above):
|
||||
|
||||
- **While restart is pending, before the deadline occurs:**
|
||||
|
||||
@ -80,7 +75,6 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window
|
||||
|
||||
## Prior to Windows 10, version 1709
|
||||
|
||||
|
||||
Two compliance flows are available:
|
||||
|
||||
- [Deadline only](#deadline-only)
|
||||
@ -104,9 +98,6 @@ Once the device is in the pending restart state, it will attempt to restart the
|
||||
|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending restart state. It specifies a deadline, in days, to enforce compliance (such as imminent installation).|
|
||||
|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled installation. The user can dismiss a reminder, but not the warning.|
|
||||
|
||||
|
||||
|
||||
|
||||
#### Suggested configuration
|
||||
|
||||
|Policy|Location|3-day compliance|5-day compliance|7-day compliance|
|
||||
@ -174,4 +165,3 @@ Notification users get for a feature update deadline:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -71,7 +71,8 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
> [!NOTE]
|
||||
>Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request.
|
||||
|
||||
@ -130,4 +131,3 @@ It is crucial to respond in a timely manner to keep the investigation moving.
|
||||
|
||||
## Related topic
|
||||
- [Microsoft Threat Experts overview](microsoft-threat-experts.md)
|
||||
|
||||
|
||||
@ -231,7 +231,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
2. Run WindowsDefenderATPOnboarding.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
|
||||
```bash
|
||||
python WindowsDefenderATPOnboarding.py
|
||||
sudo python WindowsDefenderATPOnboarding.py
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with your organization and reports a valid organization identifier:
|
||||
|
||||
@ -97,7 +97,7 @@ The package contains the following folders:
|
||||
|:---|:---------|
|
||||
|Autoruns | Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker’s persistency on the machine. </br></br> NOTE: If the registry key is not found, the file will contain the following message: “ERROR: The system was unable to find the specified registry key or value.” |
|
||||
|Installed programs | This .CSV file contains the list of installed programs that can help identify what is currently installed on the machine. For more information, see [Win32_Product class](https://go.microsoft.com/fwlink/?linkid=841509). |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewassExecutionLog.txt and pfirewall.log |
|
||||
|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.</br></br> - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process. </br></br> - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces. </br></br> ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.</br></br> - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections. </br></br> - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. </br></br> - FirewallExecutionLog.txt and pfirewall.log |
|
||||
| Prefetch files| Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might have been deleted but can still be found in the prefetch file list. </br></br> - Prefetch folder – Contains a copy of the prefetch files from `%SystemRoot%\Prefetch`. NOTE: It is suggested to download a prefetch file viewer to view the prefetch files. </br></br> - PrefetchFilesList.txt – Contains the list of all the copied files which can be used to track if there were any copy failures to the prefetch folder. |
|
||||
| Processes| Contains a .CSV file listing the running processes which provides the ability to identify current processes running on the machine. This can be useful when identifying a suspicious process and its state. |
|
||||
| Scheduled tasks| Contains a .CSV file listing the scheduled tasks which can be used to identify routines performed automatically on a chosen machine to look for suspicious code which was set to run automatically. |
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user