mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-21 13:23:36 +00:00
updated-4567381-batch4
fixed build errors and warnings
This commit is contained in:
@ -44,7 +44,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
|||||||
- Web Proxy Auto-discovery Protocol (WPAD)
|
- Web Proxy Auto-discovery Protocol (WPAD)
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Defender for Endpoint URL exclusions in the proxy, see [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Defender for Endpoint URL exclusions in the proxy, see [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
|
||||||
|
|
||||||
- Manual static proxy configuration:
|
- Manual static proxy configuration:
|
||||||
- Registry based configuration
|
- Registry based configuration
|
||||||
@ -209,7 +209,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
|
|||||||
|
|
||||||
If at least one of the connectivity options returns a (200) status, then the Defender for Endpoint client can communicate with the tested URL properly using this connectivity method. <br><br>
|
If at least one of the connectivity options returns a (200) status, then the Defender for Endpoint client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||||
|
|
||||||
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Defender for Endpoint service URLs in the proxy server](#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool.
|
> The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool.
|
||||||
|
@ -113,7 +113,7 @@ If your servers need to use a proxy to communicate with Defender for Endpoint, u
|
|||||||
|
|
||||||
- [Configure Windows to use a proxy server for all connections](configure-proxy-internet.md)
|
- [Configure Windows to use a proxy server for all connections](configure-proxy-internet.md)
|
||||||
|
|
||||||
If a proxy or firewall is in use, please ensure that servers can access all of the Microsoft Defender ATP service URLs directly and without SSL interception. For more information, see [enable access to Defender for Endpoint service URLs](configure-proxy-internet.md#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). Use of SSL interception will prevent the system from communicating with the Defender for Endpoint service.
|
If a proxy or firewall is in use, please ensure that servers can access all of the Microsoft Defender ATP service URLs directly and without SSL interception. For more information, see [enable access to Defender for Endpoint service URLs](configure-proxy-internet.md#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server). Use of SSL interception will prevent the system from communicating with the Defender for Endpoint service.
|
||||||
|
|
||||||
Once completed, you should see onboarded Windows servers in the portal within an hour.
|
Once completed, you should see onboarded Windows servers in the portal within an hour.
|
||||||
|
|
||||||
|
@ -24,7 +24,7 @@ ms.topic: article
|
|||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
To onboard devices without Internet access, you'll need to take the following general steps:
|
To onboard devices without Internet access, you'll need to take the following general steps:
|
||||||
|
|
||||||
@ -40,14 +40,14 @@ Windows Server 2016 and earlier or Windows 8.1 and earlier.
|
|||||||
|
|
||||||
For more information about onboarding methods, see the following articles:
|
For more information about onboarding methods, see the following articles:
|
||||||
- [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel)
|
- [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel)
|
||||||
- [Onboard servers to the Microsoft Defender ATP service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
|
- [Onboard servers to the Microsoft Defender for Endpoint service](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
|
||||||
- [Configure device proxy and Internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#configure-the-proxy-server-manually-using-a-registry-based-static-proxy)
|
- [Configure device proxy and Internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#configure-the-proxy-server-manually-using-a-registry-based-static-proxy)
|
||||||
|
|
||||||
## On-premise devices
|
## On-premise devices
|
||||||
|
|
||||||
- Setup Azure Log Analytics (formerly known as OMS Gateway) to act as proxy or hub:
|
- Setup Azure Log Analytics (formerly known as OMS Gateway) to act as proxy or hub:
|
||||||
- [Azure Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway)
|
- [Azure Log Analytics Agent](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway)
|
||||||
- [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp) point to Microsoft Defender ATP Workspace key & ID
|
- [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-for-endpoint) point to Microsoft Defender ATP Workspace key & ID
|
||||||
|
|
||||||
- Offline devices in the same network of Azure Log Analytics
|
- Offline devices in the same network of Azure Log Analytics
|
||||||
- Configure MMA to point to:
|
- Configure MMA to point to:
|
||||||
@ -59,7 +59,7 @@ For more information about onboarding methods, see the following articles:
|
|||||||
|
|
||||||
- Setup Azure Log Analytics Gateway (formerly known as OMS Gateway) to act as proxy or hub:
|
- Setup Azure Log Analytics Gateway (formerly known as OMS Gateway) to act as proxy or hub:
|
||||||
- [Azure Log Analytics Gateway](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway)
|
- [Azure Log Analytics Gateway](https://docs.microsoft.com/azure/azure-monitor/platform/gateway#download-the-log-analytics-gateway)
|
||||||
- [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-atp) point to Microsoft Defender ATP Workspace key & ID
|
- [Install and configure Microsoft Monitoring Agent (MMA)](configure-server-endpoints.md#install-and-configure-microsoft-monitoring-agent-mma-to-report-sensor-data-to-microsoft-defender-for-endpoint) point to Microsoft Defender ATP Workspace key & ID
|
||||||
- Offline Azure VMs in the same network of OMS Gateway
|
- Offline Azure VMs in the same network of OMS Gateway
|
||||||
- Configure Azure Log Analytics IP as a proxy
|
- Configure Azure Log Analytics IP as a proxy
|
||||||
- Azure Log Analytics Workspace Key & ID
|
- Azure Log Analytics Workspace Key & ID
|
||||||
|
@ -17,14 +17,14 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: troubleshooting
|
ms.topic: troubleshooting
|
||||||
---
|
---
|
||||||
|
|
||||||
# Troubleshoot Microsoft Defender Advanced Threat Protection live response issues
|
# Troubleshoot Microsoft Defender for Endpoint live response issues
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
This page provides detailed steps to troubleshoot live response issues.
|
This page provides detailed steps to troubleshoot live response issues.
|
||||||
@ -56,9 +56,9 @@ If while trying to take an action during a live response session, you encounter
|
|||||||
5. Run the action you wanted to take on the copied file.
|
5. Run the action you wanted to take on the copied file.
|
||||||
|
|
||||||
## Slow live response sessions or delays during initial connections
|
## Slow live response sessions or delays during initial connections
|
||||||
Live response leverages Microsoft Defender ATP sensor registration with WNS service in Windows.
|
Live response leverages Defender for Endpoint sensor registration with WNS service in Windows.
|
||||||
If you are having connectivity issues with live response, confirm the following details:
|
If you are having connectivity issues with live response, confirm the following details:
|
||||||
1. `notify.windows.com` is not blocked in your environment. For more information, see, [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
1. `notify.windows.com` is not blocked in your environment. For more information, see, [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server).
|
||||||
2. WpnService (Windows Push Notifications System Service) is not disabled.
|
2. WpnService (Windows Push Notifications System Service) is not disabled.
|
||||||
|
|
||||||
Refer to the articles below to fully understand the WpnService service behavior and requirements:
|
Refer to the articles below to fully understand the WpnService service behavior and requirements:
|
||||||
|
Reference in New Issue
Block a user