diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md index 4b781ad9c3..d42810f20f 100644 --- a/devices/surface-hub/surface-hub-2s-manage-intune.md +++ b/devices/surface-hub/surface-hub-2s-manage-intune.md @@ -48,9 +48,9 @@ To ensure optimal video and audio quality on Surface Hub 2S, add the following Q |**Name**|**Description**|**OMA-URI**|**Type**|**Value**| |:------ |:------------- |:--------- |:------ |:------- | -|**Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition | String | 50000–50019 | +|**Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition | String | 50000-50019 | |**Audio DSCP**| Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/DSCPAction | Integer | 46 | -|**Video Ports**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/SourcePortMatchCondition | String | 50020–50039 | +|**Video Ports**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/SourcePortMatchCondition | String | 50020-50039 | |**Video DSCP**| Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/DSCPAction | Integer | 34 | > [!NOTE] diff --git a/education/images/MSC17_cloud_005.png b/education/images/MSC17_cloud_005.png new file mode 100644 index 0000000000..dfda08109c Binary files /dev/null and b/education/images/MSC17_cloud_005.png differ diff --git a/education/images/MSC17_cloud_012_merged.png b/education/images/MSC17_cloud_012_merged.png new file mode 100644 index 0000000000..4defcaa59c Binary files /dev/null and b/education/images/MSC17_cloud_012_merged.png differ diff --git a/education/index.md b/education/index.md index 6c696d9f4b..f07f216119 100644 --- a/education/index.md +++ b/education/index.md @@ -32,7 +32,7 @@ ms.prod: w10
- +
@@ -51,7 +51,7 @@ ms.prod: w10
- +
@@ -63,65 +63,6 @@ ms.prod: w10
-
  • -
    • -
  • - -
    -
    -
    -
    -
    - -
    -
    -
    -

    1. M365 EDU deployment

    -

    Get started by creating your Office 365 tenant, setting up a cloud infrastructure for your school, and creating, managing, and syncing user accounts.

    -
    -
    -
    -
    -     -
    • -
  • - -
    -
    -
    -
    -
    - -
    -
    -
    -

    2. Device Management

    -

    Improve student learning outcomes through connected classrooms and engaging new technologies with streamlined device management.

    -
    -
    -
    -
    -     -
    • -
  • - -
    -
    -
    -
    -
    - -
    -
    -
    -

    3. Post Deployment Next Steps

    -

    Migrate to Sharepoint Server Hybrid or Sharepoint Online, and Exchange Server Hybrid or Exchange Online. Configure settings in your Admin portals.

    -
    -
    -
    -
    -     -
    • diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index e791545b58..ad580c30ce 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,7 @@ sections: - type: markdown text: " + @@ -55,6 +56,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusDate resolved
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4505903    		July 26, 2019
    02:00 PM PT
    Loss of functionality in Dynabook Smartphone Link app
    After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Resolved
    		July 11, 2019
    01:54 PM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Resolved
    		July 11, 2019
    01:53 PM PT
    Audio not working with Dolby Atmos headphones and home theater
    Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Resolved
    		July 11, 2019
    01:53 PM PT
    +
    DetailsOriginating updateStatusHistory
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

    This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

    Affected platforms
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4505903.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4505903    		Resolved:
    July 26, 2019
    02:00 PM PT

    Opened:
    June 28, 2019
    05:01 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: This issue was resolved in KB4501375.

    Back to top    		OS Build 18362.175

    June 11, 2019
    KB4503293    		Resolved
    KB4501375    		Resolved:
    June 27, 2019
    10:00 AM PT

    Opened:
    June 12, 2019
    11:11 AM PT
    " diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index 31c6e06ec3..f0ba7ea7a3 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,7 +60,8 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + + @@ -84,7 +85,8 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 14393.3115

    July 16, 2019
    KB4507459    		Investigating
    		July 25, 2019
    06:10 PM PT
    Internet Explorer 11 and apps using the WebBrowser control may fail to render
    JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

    See details >    		OS Build 14393.3085

    July 09, 2019
    KB4507460    		Mitigated
    		July 26, 2019
    04:58 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 14393.3115

    July 16, 2019
    KB4507459    		Investigating
    		July 26, 2019
    04:08 PM PT
    SCVMM cannot enumerate and manage logical switches deployed on the host
    For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

    See details >    		OS Build 14393.2639

    November 27, 2018
    KB4467684    		Resolved
    KB4507459    		July 16, 2019
    10:00 AM PT
    Some applications may fail to run as expected on clients of AD FS 2016
    Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

    See details >    		OS Build 14393.2941

    April 25, 2019
    KB4493473    		Resolved
    KB4507459    		July 16, 2019
    10:00 AM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 14393.3025

    June 11, 2019
    KB4503267    		Mitigated
    		July 10, 2019
    07:09 PM PT
    - + +
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507459. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 14393.3115

    July 16, 2019
    KB4507459    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Internet Explorer 11 and apps using the WebBrowser control may fail to render
    Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

    Affected platforms:
    • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server 2016
    Workaround: To mitigate this issue, you need to Enable Script Debugging using one of the following ways.

    You can configure the below registry key:
    Registry setting: HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main
    Value: Disable Script Debugger
    Type: REG_SZ
    Data: no

    Or you can Enable Script Debugging in Internet Settings. You can open Internet Setting by either typing Internet Settings into the search box on Windows or by selecting Internet Options in Internet Explorer. Once open, select Advanced then Browsing and finally, select Enable Script Debugging.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 14393.3085

    July 09, 2019
    KB4507460    		Mitigated
    		Last updated:
    July 26, 2019
    04:58 PM PT

    Opened:
    July 26, 2019
    04:58 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507459. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 14393.3115

    July 16, 2019
    KB4507459    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

    Affected platforms:
    • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
    Workaround:
    To mitigate this issue on an SCCM server:
    1. Verify Variable Window Extension is enabled.
    2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
    Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

    To mitigate this issue on a WDS server without SCCM:
    1. In WDS TFTP settings, verify Variable Window Extension is enabled.
    2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
    3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
    Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 14393.3025

    June 11, 2019
    KB4503267    		Mitigated
    		Last updated:
    July 10, 2019
    07:09 PM PT

    Opened:
    July 10, 2019
    02:51 PM PT
    " diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index 1055bb156e..b682373dce 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + @@ -79,7 +79,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 15063.1955

    July 16, 2019
    KB4507467    		Investigating
    		July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 15063.1955

    July 16, 2019
    KB4507467    		Investigating
    		July 26, 2019
    04:08 PM PT
    Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
    Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

    See details >    		OS Build 15063.1805

    May 14, 2019
    KB4499181    		Resolved
    KB4507450    		July 09, 2019
    10:00 AM PT
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 15063.1839

    May 28, 2019
    KB4499162    		Resolved
    KB4509476    		June 26, 2019
    04:00 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

    See details >    		OS Build 15063.1563

    January 08, 2019
    KB4480973    		Mitigated
    		April 25, 2019
    02:00 PM PT
    - +
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507467. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 15063.1955

    July 16, 2019
    KB4507467    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507467. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 15063.1955

    July 16, 2019
    KB4507467    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    " diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index 4667f66e88..fcd770b784 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + @@ -79,7 +79,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 16299.1296

    July 16, 2019
    KB4507465    		Investigating
    		July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 16299.1296

    July 16, 2019
    KB4507465    		Investigating
    		July 26, 2019
    04:08 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 16299.1217

    June 11, 2019
    KB4503284    		Mitigated
    		July 10, 2019
    07:09 PM PT
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 16299.1182

    May 28, 2019
    KB4499147    		Resolved
    KB4509477    		June 26, 2019
    04:00 PM PT
    Certain operations performed on a Cluster Shared Volume may fail
    Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

    See details >    		OS Build 16299.904

    January 08, 2019
    KB4480978    		Mitigated
    		April 25, 2019
    02:00 PM PT
    - +
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507465. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 16299.1296

    July 16, 2019
    KB4507465    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507465. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 16299.1296

    July 16, 2019
    KB4507465    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

    Affected platforms:
    • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
    Workaround:
    To mitigate this issue on an SCCM server:
    1. Verify Variable Window Extension is enabled.
    2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
    Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

    To mitigate this issue on a WDS server without SCCM:
    1. In WDS TFTP settings, verify Variable Window Extension is enabled.
    2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
    3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
    Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 16299.1217

    June 11, 2019
    KB4503284    		Mitigated
    		Last updated:
    July 10, 2019
    07:09 PM PT

    Opened:
    July 10, 2019
    02:51 PM PT
    " diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index 166d39fa83..d829da6310 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + @@ -80,7 +80,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 17134.915

    July 16, 2019
    KB4507466    		Investigating
    		July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 17134.915

    July 16, 2019
    KB4507466    		Investigating
    		July 26, 2019
    04:08 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 17134.829

    June 11, 2019
    KB4503286    		Mitigated
    		July 10, 2019
    07:09 PM PT
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 17134.799

    May 21, 2019
    KB4499183    		Resolved
    KB4509478    		June 26, 2019
    04:00 PM PT
    Startup to a black screen after installing updates
    Your device may startup to a black screen during the first logon after installing updates.

    See details >    		OS Build 17134.829

    June 11, 2019
    KB4503286    		Mitigated
    		June 14, 2019
    04:41 PM PT
    - +
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507466. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 17134.915

    July 16, 2019
    KB4507466    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4507466. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 17134.915

    July 16, 2019
    KB4507466    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

    Affected platforms:
    • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
    Workaround:
    To mitigate this issue on an SCCM server:
    1. Verify Variable Window Extension is enabled.
    2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
    Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

    To mitigate this issue on a WDS server without SCCM:
    1. In WDS TFTP settings, verify Variable Window Extension is enabled.
    2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
    3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
    Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 17134.829

    June 11, 2019
    KB4503286    		Mitigated
    		Last updated:
    July 10, 2019
    07:09 PM PT

    Opened:
    July 10, 2019
    02:51 PM PT
    " diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index a8d6b78e6b..65bd34e1b5 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -64,7 +64,7 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + @@ -85,7 +85,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Investigating
    		July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Investigating
    		July 26, 2019
    04:08 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Mitigated
    		July 10, 2019
    07:09 PM PT
    Difficulty connecting to some iSCSI-based SANs
    Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

    See details >    		OS Build 17763.529

    May 21, 2019
    KB4497934    		Resolved
    KB4509479    		June 26, 2019
    04:00 PM PT
    Startup to a black screen after installing updates
    Your device may startup to a black screen during the first logon after installing updates.

    See details >    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Mitigated
    		June 14, 2019
    04:41 PM PT
    - +
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4505658. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4505658. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 17763.652

    July 22, 2019
    KB4505658    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

    Affected platforms:
    • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
    Workaround:
    To mitigate this issue on an SCCM server:
    1. Verify Variable Window Extension is enabled.
    2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
    Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

    To mitigate this issue on a WDS server without SCCM:
    1. In WDS TFTP settings, verify Variable Window Extension is enabled.
    2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
    3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
    Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 17763.557

    June 11, 2019
    KB4503327    		Mitigated
    		Last updated:
    July 10, 2019
    07:09 PM PT

    Opened:
    July 10, 2019
    02:51 PM PT
    " diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a1ebf8f433..bfe5a1a1d9 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -22,7 +22,7 @@ sections:
    Current status as of July 16, 2019:
    -
    We are initiating the Windows 10 May 2019 Update for customers with devices that are at or nearing end of service and have not yet updated their device. Keeping these devices both supported and receiving monthly updates is critical to device security and ecosystem health. Based on the large number of devices running the April 2018 Update, that will reach the end of 18 months of service on November 12, 2019, we are starting the update process now for Home and Pro editions to help ensure adequate time for a smooth update process.

    Our update rollout process takes into consideration the scale and complexity of the Windows 10 ecosystem, with the many hardware, software, and app configuration options users have, to provide a seamless update experience for all users. We closely monitor update feedback to allow us to prioritize those devices likely to have a good update experience and quickly put safeguards on other devices while we address known issues. Windows 10 Home and Pro edition users will have the ability to pause the update for up to 35 days so they can choose a convenient time.

    The Windows 10 May 2019 Update is available for any user who manually selects “Check for updates” via Windows Update on a device that does not have a safeguard hold for issues already detected. If you are not offered the update, please check below for any known issues that may affect your device.

    We recommend commercial customers running earlier versions of Windows 10 begin targeted deployments of Windows 10, version 1903 to validate that the apps, devices, and infrastructure used by their organizations work as expected with the new release and features.

    Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard.
    +
    We are initiating the Windows 10 May 2019 Update for customers with devices that are at or nearing end of service and have not yet updated their device. Keeping these devices both supported and receiving monthly updates is critical to device security and ecosystem health. Based on the large number of devices running the April 2018 Update, that will reach the end of 18 months of service on November 12, 2019, we are starting the update process now for Home and Pro editions to help ensure adequate time for a smooth update process.

    Our update rollout process takes into consideration the scale and complexity of the Windows 10 ecosystem, with the many hardware, software, and app configuration options users have, to provide a seamless update experience for all users. We closely monitor update feedback to allow us to prioritize those devices likely to have a good update experience and quickly put safeguards on other devices while we address known issues. Windows 10 Home and Pro edition users will have the ability to pause the update for up to 35 days so they can choose a convenient time.

    The Windows 10 May 2019 Update is available for any user who manually selects “Check for updates” via Windows Update on a device that does not have a safeguard hold for issues already detected. If you are not offered the update, please check below for any known issues that may affect your device.

    We recommend commercial customers running earlier versions of Windows 10 begin targeted deployments of Windows 10, version 1903 to validate that the apps, devices, and infrastructure used by their organizations work as expected with the new release and features.

    Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard.
    " @@ -65,7 +65,8 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - + + @@ -73,7 +74,6 @@ sections: - @@ -97,7 +97,7 @@ sections: - type: markdown text: "
    SummaryOriginating updateStatusLast updated
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		July 25, 2019
    06:10 PM PT
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4505903    		July 26, 2019
    02:00 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		July 26, 2019
    04:08 PM PT
    Issues updating when certain versions of Intel storage drivers are installed
    Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Mitigated External
    		July 25, 2019
    06:10 PM PT
    The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
    Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		July 16, 2019
    09:04 AM PT
    Initiating a Remote Desktop connection may result in black screen
    When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		July 12, 2019
    04:42 PM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Resolved
    		July 11, 2019
    01:53 PM PT
    Audio not working with Dolby Atmos headphones and home theater
    Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Resolved
    		July 11, 2019
    01:53 PM PT
    Devices starting using PXE from a WDS or SCCM servers may fail to start
    Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

    See details >    		OS Build 18362.175

    June 11, 2019
    KB4503293    		Mitigated
    		July 10, 2019
    07:09 PM PT
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

    See details >    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Mitigated
    		July 01, 2019
    05:04 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

    See details >    		OS Build 18362.175

    June 11, 2019
    KB4503293    		Resolved
    KB4501375    		June 27, 2019
    10:00 AM PT
    Windows Sandbox may fail to start with error code “0x80070002”
    Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		June 10, 2019
    06:06 PM PT
    Gamma ramps, color profiles, and night light settings do not apply in some cases
    Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 24, 2019
    11:02 AM PT
    - + @@ -110,7 +110,7 @@ sections: - type: markdown text: "
    DetailsOriginating updateStatusHistory
    Domain connected devices that use MIT Kerberos realms may not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4497935. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Domain connected devices that use MIT Kerberos realms will not start up
    Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

    If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
    • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
    Next steps: At this time, we suggest that devices in an affected environment do not install KB4497935. We are working on a resolution and estimate a solution will be available in mid-August.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		Last updated:
    July 26, 2019
    04:08 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    Issues updating when certain versions of Intel storage drivers are installed
    Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

    To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST driver version between 15.1.0.1002 and 15.5.2.1053 installed from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.6.1044.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Next steps: To resolve this issue, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for the May 2019 Update.

    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Mitigated External
    		Last updated:
    July 25, 2019
    06:10 PM PT

    Opened:
    July 25, 2019
    06:10 PM PT
    The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
    Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

    To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		Last updated:
    July 16, 2019
    09:04 AM PT

    Opened:
    July 12, 2019
    04:20 PM PT
    Initiating a Remote Desktop connection may result in black screen
    When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Next steps: We are working on a resolution that will be made available in upcoming release.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Investigating
    		Last updated:
    July 12, 2019
    04:42 PM PT

    Opened:
    July 12, 2019
    04:42 PM PT
    - +
    DetailsOriginating updateStatusHistory
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

    This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

    Affected platforms
    • Client: Windows 10, version 1903
    Workaround: To mitigate this issue, use one of the steps below, either the group policy step or the registry step, to configure one of the default telemetry settings:

    Set the value for the following group policy settings:
    1. Group Policy Path: Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\Allow Telemetry
    2. Safe Policy Setting: Enabled and set to 1 (Basic) or 2 (Enhanced) or 3 (Full)

    Or set the following registry value:

    SubKey: HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection

    Setting: AllowTelemetry

    Type: REG_DWORD

    Value: 1, 2 or 3


    Note If the Remote Access Connection Manager service is not running after setting the Group Policy or registry key, you will need to manually start the service or restart the device.

    Next Steps: We are working on a resolution and estimate a solution will be available in late July.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Mitigated
    		Last updated:
    July 01, 2019
    05:04 PM PT

    Opened:
    June 28, 2019
    05:01 PM PT
    RASMAN service may stop working and result in the error “0xc0000005”
    The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

    This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

    Affected platforms
    • Client: Windows 10, version 1903
    Resolution: This issue was resolved in KB4505903.

    Back to top    		OS Build 18362.145

    May 29, 2019
    KB4497935    		Resolved
    KB4505903    		Resolved:
    July 26, 2019
    02:00 PM PT

    Opened:
    June 28, 2019
    05:01 PM PT
    Event Viewer may close or you may receive an error when using Custom Views
    When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
    • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
    Resolution: This issue was resolved in KB4501375.

    Back to top    		OS Build 18362.175

    June 11, 2019
    KB4503293    		Resolved
    KB4501375    		Resolved:
    June 27, 2019
    10:00 AM PT

    Opened:
    June 12, 2019
    11:11 AM PT
    " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index 9d2980d85a..037d852171 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -49,12 +49,12 @@ sections: - type: markdown text: " - - + + - - + + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 2882b9ae0f..77971cf333 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -104,7 +104,20 @@ ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/overview-hunting.md) #### [Query data using Advanced hunting](microsoft-defender-atp/advanced-hunting.md) -##### [Advanced hunting reference](microsoft-defender-atp/advanced-hunting-reference.md) + +##### [Advanced hunting schema reference]() +###### [All tables in the Advanced hunting schema](microsoft-defender-atp/advanced-hunting-reference.md) +###### [AlertEvents table](microsoft-defender-atp/advanced-hunting-alertevents-table.md) +###### [FileCreationEvents table](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) +###### [ImageLoadEvents table](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) +###### [LogonEvents table](microsoft-defender-atp/advanced-hunting-logonevents-table.md) +###### [MachineInfo table](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) +###### [MachineNetworkInfo table](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) +###### [MiscEvents table](microsoft-defender-atp/advanced-hunting-miscevents-table.md) +###### [NetworkCommunicationEvents table](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) +###### [ProcessCreationEvents table](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) +###### [RegistryEvents table](microsoft-defender-atp/advanced-hunting-registryevents-table.md) + ##### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) #### [Custom detections]() @@ -129,7 +142,7 @@ ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) ### [Portal overview](microsoft-defender-atp/portal-overview.md) - +### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md) ## [Get started]() ### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) @@ -140,6 +153,9 @@ ### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) ### [Assign user access to the portal](microsoft-defender-atp/assign-portal-access.md) + + + ### [Evaluate Microsoft Defender ATP]() #### [Attack surface reduction and next-generation capability evaluation]() ##### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index d85f33b6b5..05cbed96aa 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -67,7 +67,7 @@ The attack surface reduction set of capabilities provide the first line of defen - [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md) - [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md) - [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -- [Attack surface reduction controls](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) +- [Attack surface reduction rules](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md new file mode 100644 index 0000000000..9544001b7c --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -0,0 +1,54 @@ +--- +title: AlertEvents table in the advanced hunting schema +description: Learn about the AlertEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, alertevent +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# AlertEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The AlertEvents table in the Advanced hunting schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| AlertId | string | Unique identifier for the alert | +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | +| Category | string | Type of threat indicator or breach activity identified by the alert | +| Title | string | Title of the alert | +| FileName | string | Name of the file that the recorded action was applied to | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | +| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | +| RemoteIP | string | IP address that was being connected to | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| Table | string | Table that contains the details of the event | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md new file mode 100644 index 0000000000..a82f47f963 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md @@ -0,0 +1,73 @@ +--- +title: FileCreationEvents table in the Advanced hunting schema +description: Learn about the FileCreationEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, filecreationevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# FileCreationEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The FileCreationEvents table in the Advanced hunting schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| FileName | string | Name of the file that the recorded action was applied to | +| FolderPath | string | Folder containing the file that the recorded action was applied to | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | +| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| MD5 | string | MD5 hash of the file that the recorded action was applied to | +| FileOriginUrl | string | URL where the file was downloaded from | +| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file | +| FileOriginIP | string | IP address where the file was downloaded from | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | +| SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | +| IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md new file mode 100644 index 0000000000..d7e0521472 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md @@ -0,0 +1,66 @@ +--- +title: ImageLoadEvents table in the Advanced hunting schema +description: Learn about the ImageLoadEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, imageloadevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# ImageLoadEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The ImageLoadEvents table in the Advanced hunting schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| FileName | string | Name of the file that the recorded action was applied to | +| FolderPath | string | Folder containing the file that the recorded action was applied to | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | +| MD5 | string | MD5 hash of the file that the recorded action was applied to | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md new file mode 100644 index 0000000000..1e8a0cfcc7 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md @@ -0,0 +1,74 @@ +--- +title: LogonEvents table in the Advanced hunting schema +description: Learn about the LogonEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, logonevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# LogonEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The LogonEvents table in the Advanced hunting schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string |Type of activity that triggered the event | +| AccountDomain | string | Domain of the account | +| AccountName | string | User name of the account | +| AccountSid | string | Security Identifier (SID) of the account | +| LogonType | string | Type of logon session, specifically:

    - **Interactive** - User physically interacts with the machine using the local keyboard and screen

    - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

    - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

    - **Batch** - Session initiated by scheduled tasks

    - **Service** - Session initiated by services as they start
    | +| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| RemoteIP | string | IP address that was being connected to | +| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| RemotePort | int | TCP port on the remote device that was being connected to | +| AdditionalFields | string | Additional information about the event in JSON array format | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md new file mode 100644 index 0000000000..fa58a67cdd --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md @@ -0,0 +1,55 @@ +--- +title: MachineInfo table in the Advanced hunting schema +description: Learn about the MachineInfo table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, machineinfo +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# MachineInfo + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The MachineInfo table in the Advanced hunting schema contains information about machines in the organization, including OS version, active users, and computer name. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ClientVersion | string | Version of the endpoint agent or sensor running on the machine | +| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | +| OSArchitecture | string | Architecture of the operating system running on the machine | +| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | +| OSBuild | string | Build version of the operating system running on the machine | +| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | +| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | +| RegistryMachineTag | string | Machine tag added through the registry | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| OSVersion | string | Version of the operating system running on the machine | +| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md new file mode 100644 index 0000000000..3ec3dfd8f2 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md @@ -0,0 +1,56 @@ +--- +title: MachineNetworkInfo table in the Advanced hunting schema +description: Learn about the MachineNetworkInfo table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, machinenetworkinfo +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# MachineNetworkInfo + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The MachineNetworkInfo table in the Advanced hunting schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| NetworkAdapterName | string | Name of the network adapter | +| MacAddress | string | MAC address of the network adapter | +| NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | +| NetworkAdapterStatus | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | +| TunnelType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | +| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | +| DnsAddresses | string | DNS server addresses in JSON array format | +| IPv4Dhcp | string | IPv4 address of DHCP server | +| IPv6Dhcp | string | IPv6 address of DHCP server | +| DefaultGateways | string | Default gateway addresses in JSON array format | +| IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md new file mode 100644 index 0000000000..01c38628be --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md @@ -0,0 +1,87 @@ +--- +title: MiscEvents table in the advanced hunting schema +description: Learn about the MiscEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, miscEvents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# MiscEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The MiscEvents table in the Advanced hunting schema contains information about multiple event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| FileName | string | Name of the file that the recorded action was applied to | +| FolderPath | string | Folder containing the file that the recorded action was applied to | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | +| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| MD5 | string | MD5 hash of the file that the recorded action was applied to | +| AccountDomain | string | Domain of the account | +| AccountName |string | User name of the account | +| AccountSid | string | Security Identifier (SID) of the account | +| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | +| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| ProcessId | int | Process ID (PID) of the newly created process | +| ProcessCommandLine | string | Command line used to create the new process | +| ProcessCreationTime | datetime | Date and time the process was created | +| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| RegistryKey | string | Registry key that the recorded action was applied to | +| RegistryValueName | string | Name of the registry value that the recorded action was applied to | +| RegistryValueData | string | Data of the registry value that the recorded action was applied to | +| RemoteIP | string | IP address that was being connected to | +| RemotePort | int | TCP port on the remote device that was being connected to | +| LocalIP | string | IP address assigned to the local machine used during communication | +| LocalPort | int | TCP port on the local machine used during communication | +| FileOriginUrl | string | URL where the file was downloaded from | +| FileOriginIP | string | IP address where the file was downloaded from | +| AdditionalFields | string | Additional information about the event in JSON array format | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md new file mode 100644 index 0000000000..fb18d453d7 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md @@ -0,0 +1,70 @@ +--- +title: NetworkCommunicationEvents table in the Advanced hunting schema +description: Learn about the NetworkCommunicationEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, networkcommunicationevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# NetworkCommunicationEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The NetworkCommunicationEvents table in the Advanced hunting schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| RemoteIP | string | IP address that was being connected to | +| RemotePort | int | TCP port on the remote device that was being connected to | +| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | +| LocalIP | string | IP address assigned to the local machine used during communication | +| LocalPort | int | TCP port on the local machine used during communication | +| Protocol | string | IP protocol used, whether TCP or UDP | +| LocalIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md new file mode 100644 index 0000000000..d6ef50a878 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md @@ -0,0 +1,78 @@ +--- +title: ProcessCreationEvents table in the Advanced hunting schema +description: Learn about the ProcessCreationEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, processcreationevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# ProcessCreationEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The ProcessCreationEvents table in the Advanced hunting schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| FileName | string | Name of the file that the recorded action was applied to | +| FolderPath | string | Folder containing the file that the recorded action was applied to | +| SHA1 | string | SHA-1 of the file that the recorded action was applied to | +| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | +| MD5 | string | MD5 hash of the file that the recorded action was applied to | +| ProcessId | int | Process ID (PID) of the newly created process | +| ProcessCommandLine | string | Command line used to create the new process | +| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources | +| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| ProcessCreationTime | datetime | Date and time the process was created | +| AccountDomain | string | Domain of the account | +| AccountName | string | User name of the account | +| AccountSid | string | Security Identifier (SID) of the account | +| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md index 0233da71e9..40810a2f12 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md @@ -1,6 +1,6 @@ --- -title: Advanced hunting reference in Microsoft Defender ATP -description: Learn about Advanced hunting table reference such as column name, data type, and description +title: Advanced hunting schema reference +description: Learn about the tables in the advanced hunting schema keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,7 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 06/01/2018 +ms.date: 07/24/2019 --- # Advanced hunting reference in Microsoft Defender ATP @@ -26,101 +26,28 @@ ms.date: 06/01/2018 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -## Advanced hunting column reference -To effectively build queries that span multiple tables, you need to understand the columns in the Advanced hunting schema. The following table lists all the available columns, along with their data types and descriptions. This information is also available in the schema representation in the Advanced hunting screen. +## Advanced hunting table reference -| Column name | Data type | Description -:---|:--- |:--- -| AccountDomain | string | Domain of the account | -| AccountName | string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| ActionType | string | Type of activity that triggered the event | -| AdditionalFields | string | Additional information about the event in JSON array format | -| AlertId | string | Unique identifier for the alert | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| Category | string | Type of threat indicator or breach activity identified by the alert | -| ClientVersion | string | Version of the endpoint agent or sensor running on the machine | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | -| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it’s connected publicly to the internet. | -| DefaultGateways | string | Default gateway addresses in JSON array format | -| DnsAddresses | string | DNS server addresses in JSON array format | -| EventTime | datetime | Date and time when the event was recorded | -| FileName | string | Name of the file that the recorded action was applied to | -| FileOriginIp | string | IP address where the file was downloaded from | -| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file | -| FileOriginUrl | string | URL where the file was downloaded from | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources. | -| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | -| InitiatingProcessMd5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available. | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | -| Ipv4Dhcp | string | IPv4 address of DHCP server | -| Ipv6Dhcp | string | IPv6 address of DHCP server | -| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | -| IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection | -| LocalIP | string | IP address assigned to the local machine used during communication | -| LocalPort | int | TCP port on the local machine used during communication | -| LocalIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts. | -| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| LogonType | string | Type of logon session, specifically:

    - **Interactive** - User physically interacts with the machine using the local keyboard and screen

    - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

    - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

    - **Batch** - Session initiated by scheduled tasks

    - **Service** - Session initiated by services as they start
    -| MacAddress | string | MAC address of the network adapter | -| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine. | -| MachineId | string | Unique identifier for the machine in the service | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| NetworkAdapterName | string | Name of the network adapter | -| NetworkAdapterStatus | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2). | -| NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2). | -| OSArchitecture | string | Architecture of the operating system running on the machine | -| OSBuild | string | Build version of the operating system running on the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | -| OsVersion | string | Version of the operating system running on the machine | -| PreviousRegistryKey | string | Original registry key of the registry value before it was modified | -| PreviousRegistryValueData | string | Original data of the registry value before it was modified | -| PreviousRegistryValueName | string | Original name of the registry value before it was modified | -| PreviousRegistryValueType | string | Original data type of the registry value before it was modified | -| ProcessCommandline | string | Command line used to create the new process | -| ProcessCreationTime | datetime | Date and time the process was created | -| ProcessId | int | Process ID (PID) of the newly created process | -| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. | -| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| Protocol | string | IP protocol used, whether TCP or UDP | -| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy. | -| RegistryKey | string | Registry key that the recorded action was applied to | -| RegistryValueData | string | Data of the registry value that the recorded action was applied to | -| RegistryValueName | string | Name of the registry value that the recorded action was applied to | -| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. | -| RemoteIP | string | IP address that was being connected to | -| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| RemotePort | int | TCP port on the remote device that was being connected to | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns. | -| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | -| SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | -| SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | -| RegistryMachineTag | string | Machine tag added through the registry | -| Table | string | Table that contains the details of the event | -| TunnelingType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | +The Advanced hunting schema is made up of multiple tables that provide either event information or information about certain entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink) +The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table. + +Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the Advanced hunting screen. + +| Table name | Description | +|------------|-------------| +| **[AlertEvents](advanced-hunting-alertevents-table.md)** | Alerts on Microsoft Defender Security Center | +| **[MachineInfo](advanced-hunting-machineinfo-table.md)** | Machine information, including OS information | +| **[MachineNetworkInfo](advanced-hunting-machinenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | +| **[ProcessCreationEvents](advanced-hunting-processcreationevents-table.md)** | Process creation and related events | +| **[NetworkCommunicationEvents](advanced-hunting-networkcommunicationevents-table.md)** | Network connection and related events | +| **[FileCreationEvents](advanced-hunting-filecreationevents-table.md)** | File creation, modification, and other file system events | +| **[RegistryEvents](advanced-hunting-registryevents-table.md)** | Creation and modification of registry entries | +| **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events | +| **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events | +| **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | ## Related topics + - [Query data using Advanced hunting](advanced-hunting.md) -- [Advanced hunting query language best practices](advanced-hunting-best-practices.md) \ No newline at end of file +- [Best practices for Advanced hunting query-writing](advanced-hunting-best-practices.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md new file mode 100644 index 0000000000..75b7b12ee6 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md @@ -0,0 +1,68 @@ +--- +title: RegistryEvents table in the Advanced hunting schema +description: Learn about the RegistryEvents table in the Advanced hunting schema, such as column names, data types, and descriptions +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, registryevents +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# RegistryEvents + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +The RegistryEvents table in the Advanced hunting schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. + +For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ActionType | string | Type of activity that triggered the event | +| RegistryKey | string | Registry key that the recorded action was applied to | +| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | +| RegistryValueName | string | Name of the registry value that the recorded action was applied to | +| RegistryValueData | string | Data of the registry value that the recorded action was applied to | +| PreviousRegistryValueName | string | Original name of the registry value before it was modified | +| PreviousRegistryValueData | string | Original data of the registry value before it was modified | +| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | +| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | +| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | +| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | +| InitiatingProcessFileName | string | Name of the process that initiated the event | +| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | +| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | +| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | +| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | +| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | +| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + +## Related topics + +- [Advanced hunting overview](overview-hunting.md) +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md new file mode 100644 index 0000000000..dfff630e9d --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md @@ -0,0 +1,96 @@ +--- +title: Microsoft Defender ATP for US Government GCC High customers +description: Learn about the requirements and the available Microsoft Defender ATP capabilities for US Government CCC High customers +keywords: government, gcc, high, requirements, capabilities, defender, defender atp, mdatp +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Microsoft Defender ATP for US Government GCC High customers + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for US Government Community Cloud High (GCC High) customers, built in the US Azure Government environment, uses the same underlying technologies as Microsoft Defender ATP in Azure Commercial. + +This offering is currently available to US Office 365 GCC High customers and is based on the same prevention, detection, investigation, and remediation as the commercial version. However, there are some key differences in the availability of capabilities for this offering. + + +## Endpoint versions +The following OS versions are supported: + +- Windows 10, version 1903 +- Windows 10, version 1809 (OS Build 17763.404 with [KB4490481](https://support.microsoft.com/en-us/help/4490481)) +- Windows 10, version 1803 (OS Build 17134.799 with [KB4499183](https://support.microsoft.com/help/4499183)) +- Windows 10, version 1709 (OS Build 16299.1182 with [KB4499147](https://support.microsoft.com/help/4499147)) +- Windows Server, 2019 (with [KB4490481](https://support.microsoft.com/en-us/help/4490481)) + +>[!NOTE] +>A patch must be deployed before machine onboarding in order to configure Microsoft Defender ATP to the correct environment. + +The following OS versions are not supported: +- Windows Server 2008 R2 SP1 +- Windows Server 2012 R2 +- Windows Server 2016 +- Windows Server, version 1803 +- Windows 7 SP1 Enterprise +- Windows 7 SP1 Pro +- Windows 8 Pro +- Windows 8.1 Enterprise +- macOS + +The initial release of Microsoft Defender ATP will not have immediate parity with the commercial offering. While our goal is to deliver all commercial features and functionality to our US Government (GCC High) customers, there are some capabilities not yet available that we'd like to highlight. These are the known gaps as of August 2019: + +## Threat & Vulnerability Management +Not currently available. + + +## Automated investigation and remediation +The following capabilities are not currently available: +- Response to Office 365 alerts +- Live response + + + +## Management and APIs +The following capabilities are not currently available: + +- Threat protection report +- Machine health and compliance report +- Integration with third-party products + + +## Integrations +Integrations with the following Microsoft products are not currently available: +- Azure Security Center +- Azure Advanced Threat Protection +- Azure Information Protection +- Office 365 Advanced Threat Protection +- Microsoft Cloud App Security +- Skype for Business +- Microsoft Intune (sharing of device information and enhanced policy enforcement) + +## Microsoft Threat Experts +Not currently available. + +## Required connectivity settings +You'll need to ensure that traffic from the following are allowed: + +Service location | DNS record +:---|:--- +Common URLs for all locations (Global location) | ```crl.microsoft.com```
    ```ctldl.windowsupdate.com```
    ```notify.windows.com``` +Microsoft Defender ATP GCC High specific | ```us4-v20.events.data.microsoft.com```
    ```winatp-gw-usgt.microsoft.com```
    ```winatp-gw-usgv.microsoft.com```
    ```*.blob.core.usgovcloudapi.net``` + + + diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md index d6b0b6bed5..785daef982 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md @@ -22,8 +22,6 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) [Attack surface reduction (ASR) rules](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) identify and prevent actions that are typically taken by malware during exploitation. These rules control when and how potentially malicious code can run. For example, you can prevent JavaScript or VBScript from launching a downloaded executable, block Win32 API calls from Office macros, or block processes that run from USB drives. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 5c01117055..4640790859 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -22,14 +22,13 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) Each onboarded machine adds an additional endpoint detection and response (EDR) sensor and increases visibility over breach activity in your network. Onboarding also ensures that a machine can be checked for vulnerable components as well security configuration issues and can receive critical remediation actions during attacks. ->[!NOTE] ->Before you can track and manage onboarding of machines, [enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management). +Before you can track and manage onboarding of machines: +- [Enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management) +- [Ensure you have the necessary permissions](configure-machines.md#obtain-required-permissions) ## Discover and track unprotected machines @@ -39,8 +38,7 @@ The **Onboarding** card provides a high-level overview of your onboarding rate b *Card showing onboarded machines compared to the total number of Intune-managed Windows 10 machine* >[!NOTE] ->- If you used Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles, you might encounter data discrepancies. To resolve these discrepancies, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to your machines. ->- During preview, you might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune. +>If you used Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles, you might encounter data discrepancies. To resolve these discrepancies, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to your machines. ## Onboard more machines with Intune profiles @@ -66,10 +64,10 @@ From the overview, create a configuration profile specifically for the deploymen 3. After creating the profile, assign it to all your machines. You can review profiles and their deployment status anytime by accessing **Device configuration > Profiles** on Intune. ![Profile assignment screen on Intune](images/secconmgmt_onboarding_3assignprofile.png)
    - *Assigning the new agent profile to all machines* + *Assigning the new profile to all machines* >[!TIP] ->To learn more about Intune profiles, read [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/intune/device-profile-assign). +>To learn more about Intune profiles, read about [assigning user and device profiles](https://docs.microsoft.com/intune/device-profile-assign). >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md index 9ef47de4a4..5c04c5d86d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md @@ -22,16 +22,15 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) Security baselines ensure that security features are configured according to guidance from both security experts and expert Windows system administrators. When deployed, the Microsoft Defender ATP security baseline sets Microsoft Defender ATP security controls to provide optimal protection. To understand security baselines and how they are assigned on Intune using configuration profiles, [read this FAQ](https://docs.microsoft.com/intune/security-baselines#q--a). ->[!NOTE] ->Before you can track and manage compliance to the Microsoft Defender ATP security baseline, [enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management). +Before you can deploy and track compliance to security baselines: +- [Enroll your machines to Intune management](configure-machines.md#enroll-machines-to-intune-management) +- [Ensure you have the necessary permissions](configure-machines.md#obtain-required-permissions) ## Compare the Microsoft Defender ATP and the Windows Intune security baselines The Windows Intune security baseline provides a comprehensive set of recommended settings needed to securely configure machines running Windows, including browser settings, PowerShell settings, as well as settings for some security features like Windows Defender Antivirus. In contrast, the Microsoft Defender ATP baseline provides settings that optimize all the security controls in the Microsoft Defender ATP stack, including settings for endpoint detection and response (EDR) as well as settings also found in the Windows Intune security baseline. For more information about each baseline, see: @@ -44,17 +43,6 @@ Both baselines are maintained so that they complement one another and have ident >[!NOTE] >The Microsoft Defender ATP security baseline has been optimized for physical devices and is currently not recommended for use on virtual machines (VMs) or VDI endpoints. Certain baseline settings can impact remote interactive sessions on virtualized environments. -## Get permissions to manage security baselines in Intune - -By default, only users who have been assigned the Global Administrator or the Intune Service Administrator role on Azure AD can manage security baseline profiles. If you haven’t been assigned either role, work with a Global Administrator or an Intune Service Administrator to [create and assign a custom role in Intune](https://docs.microsoft.com/intune/create-custom-role#to-create-a-custom-role) with: - -* Read permissions to the organization -* Full permissions to security baselines - -![Security baseline permissions on Intune](images/secconmgmt_baseline_permissions.png) - -*Security baseline permissions on Intune* - ## Monitor compliance to the Microsoft Defender ATP security baseline The **Security baseline** card on [machine configuration management](configure-machines.md) provides an overview of compliance across Windows 10 machines that have been assigned the Microsoft Defender ATP security baseline. @@ -71,10 +59,8 @@ Each machine is given one of the following status types: To review specific machines, select **Configure security baseline** on the card. This takes you to Intune device management. From there, select **Device status** for the names and statuses of the machines. ->[!NOTE] ->During preview, you might encounter a few known limitations: ->- You might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune. ->- The Microsoft Defender ATP security baseline currently doesn’t cover settings for all Microsoft Defender ATP security controls, including settings for exploit protection and Application Guard. +>[!NOTE] +>You might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune. ## Review and assign the Microsoft Defender ATP security baseline @@ -83,7 +69,7 @@ Machine configuration management monitors baseline compliance only of Windows 10 1. Select **Configure security baseline** on the **Security baseline** card to go to Intune device management. A similar overview of baseline compliance is displayed. >[!TIP] - > Alternatively, you can navigate to the Microsoft Defender ATP security baseline in the Microsoft Azure portal from **All services > Intune > Device security > Security baselines (preview) > PREVIEW: Windows Defender ATP baseline**. + > Alternatively, you can navigate to the Microsoft Defender ATP security baseline in the Microsoft Azure portal from **All services > Intune > Device security > Security baselines > Microsoft Defender ATP baseline**. 2. Create a new profile. @@ -101,10 +87,10 @@ Machine configuration management monitors baseline compliance only of Windows 10 ![Security baseline profiles on Intune](images/secconmgmt_baseline_intuneprofile3.png)
    *Assigning the security baseline profile on Intune* -5. Save the profile and deploy it to the assigned machine group. +5. Create the profile to save it and deploy it to the assigned machine group. ![Assigning the security baseline on Intune](images/secconmgmt_baseline_intuneprofile4.png)
    - *Saving and deploying the security baseline profile on Intune* + *Creating the security baseline profile on Intune* >[!TIP] >Security baselines on Intune provide a convenient way to comprehensively secure and protect your machines. [Learn more about security baselines on Intune](https://docs.microsoft.com/intune/security-baselines). diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md index 05869b764d..11f16e8b9f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md @@ -22,8 +22,6 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) With properly configured machines, you can boost overall resilience against threats and enhance your capability to detect and respond to attacks. Security configuration management helps ensure that your machines: @@ -47,7 +45,7 @@ In doing so, you benefit from: Machine configuration management works closely with Intune device management to establish the inventory of the machines in your organization and the baseline security configuration. You will be able to track and manage configuration issues on Intune-managed Windows 10 machines. -Before you can ensure your machines are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 machines. For more information about Intune enrollment options, read [Set up enrollment for Windows devices](https://docs.microsoft.com/intune/windows-enroll). +Before you can ensure your machines are configured properly, enroll them to Intune management. Intune enrollment is robust and has several enrollment options for Windows 10 machines. For more information about Intune enrollment options, read about [setting up enrollment for Windows devices](https://docs.microsoft.com/intune/windows-enroll). >[!NOTE] >To enroll Windows devices to Intune, administrators must have already been assigned licenses. [Read about assigning licenses for device enrollment](https://docs.microsoft.com/intune/licenses-assign). @@ -55,12 +53,21 @@ Before you can ensure your machines are configured properly, enroll them to Intu >[!TIP] >To optimize machine management through Intune, [connect Intune to Microsoft Defender ATP](https://docs.microsoft.com/intune/advanced-threat-protection#enable-windows-defender-atp-in-intune). -## Known issues and limitations in this preview -During preview, you might encounter a few known limitations: -- You might experience discrepancies in aggregated data displayed on the machine configuration management page and those displayed on overview screens in Intune. -- The count of onboarded machines tracked by machine configuration management might not include machines onboarded using Security Center Configuration Manager, the onboarding script, or other onboarding methods that don’t use Intune profiles. To include these machines, create a corresponding Intune configuration profile for Microsoft Defender ATP onboarding and assign that profile to these machines. -- The Microsoft Defender ATP security baseline currently doesn’t cover settings for all Microsoft Defender ATP security controls, including settings for exploit protection and Application Guard. +## Obtain required permissions +By default, only users who have been assigned the Global Administrator or the Intune Service Administrator role on Azure AD can manage and assign the device configuration profiles needed for onboarding machines and deploying the security baseline. +If you have been assigned other roles, ensure you have the necessary permissions: + +- Full permissions to device configurations +- Full permissions to security baselines +- Read permissions to device compliance policies +- Read permissions to the organization + +![Required permissions on intune](images/secconmgmt_intune_permissions.png)
    +*Device configuration permissions on Intune* + +>[!TIP] +>To learn more about assigning permissions on Intune, [read about creating custom roles](https://docs.microsoft.com/intune/create-custom-role#to-create-a-custom-role). ## In this section Topic | Description diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index cbeed1d1ea..c5b282a4f3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -63,6 +63,9 @@ The machine will automatically be onboarded to your tenant with the recommended Automated investigation settings will be dependent on tenant settings. It will be configured to be semi-automated by default. For more information, see [Overview of Automated investigations](automated-investigations.md). +>[!NOTE] +>The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. + 1. In the navigation pane, select **Evaluation and tutorials > Evaluation lab**. @@ -72,7 +75,7 @@ Automated investigation settings will be dependent on tenant settings. It will b 3. Select **Add machine**. - >[!NOTE] + >[!WARNING] > The evaluation environment can only be provisioned up to three test machines. Each machine will only be available for three days from the day of activation. ![Image of add machine](images/evaluation-add-machine.png) @@ -89,6 +92,7 @@ Automated investigation settings will be dependent on tenant settings. It will b The environment will reflect your test machine status through the evaluation - including risk score, exposure score, and alerts created through the simulation. + ![Image of test machines](images/eval-lab-dashboard.png) ## Simulate attack scenarios @@ -98,6 +102,9 @@ If you are looking for a pre-made simulation, you can use our ["Do It Yourself" You can also use [Advanced hunting](advanced-hunting.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats. +>[!NOTE] +>The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections. + 1. Connect to your machine and run an attack simulation by selecting **Connect**. ![Image of the connect button for test machines](images/test-machine-table.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png index f8147866f5..78c605fd6d 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile1.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png index a6b401f564..4b1576ec23 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile2.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png index 8f88c5899e..0e1f7069f5 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile3.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png index 2955624a72..93111cb58b 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_intuneprofile4.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_permissions.png deleted file mode 100644 index c97ef90085..0000000000 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_baseline_permissions.png and /dev/null differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_intune_permissions.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_intune_permissions.png new file mode 100644 index 0000000000..c40ac907c4 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_intune_permissions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_1deviceconfprofile.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_1deviceconfprofile.png index 097725199f..1f46df00ee 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_1deviceconfprofile.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_1deviceconfprofile.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_2deviceconfprofile.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_2deviceconfprofile.png index 7a14844ecd..257048acb1 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_2deviceconfprofile.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_2deviceconfprofile.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_3assignprofile.png b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_3assignprofile.png index 1a2f78c4ea..858e304bb5 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_3assignprofile.png and b/windows/security/threat-protection/microsoft-defender-atp/images/secconmgmt_onboarding_3assignprofile.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md index 1d466fca97..ccc8855e33 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md @@ -46,7 +46,7 @@ The Microsoft secure score tile is reflective of the sum of all the Microsoft De Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar). -The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/en-us/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess). +The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess). In the example image, the total points for the Windows security controls and Office 365 add up to 602 points.
    MessageDate
    Status update: Windows 10, version 1903 “D” release
    The optional monthly “D” release for Windows 10, version 1903 will be available in the near term. Follow @WindowsUpdate for the latest on the availability of this release.
    		July 24, 2019
    12:00 AM PT
    Status update: Windows 10, version 1903 “D” release now available
    The optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
    		July 26, 2019
    02:00 PM PT
    Plan for change: Microsoft Silverlight will reach end of support on October 12, 2021
    After this date, Silverlight will not receive any future quality or security updates. Microsoft will continue to ship updates to the Silverlight 5 Developer Runtime for supported browsers and versions (Internet Explorer 10 and Internet Explorer 11); however, please note that support for Internet Explorer 10 will end on 31 January 2020. See the Silverlight end of support FAQ for more details.
    		July 19, 2019
    12:00 AM PT
    Evolving Windows 10 servicing and quality
    Find out how we plan to further optimize the delivery of the next Windows 10 feature update for devices running Windows 10, version 1903. If you're a commercial customer, please see the Windows IT Pro Blog for more details on how to plan for this new update option in your environment.
    		July 01, 2019
    02:00 PM PT
    Windows 10, version 1903 starting to roll out to devices running Windows 10, version 1803 and earlier
    We are now beginning to build and train the machine learning (ML) based rollout process to update devices running Windows 10, version 1803 (the April 2018 Update) and earlier versions of Windows 10, to ensure we can continue to service these devices and provide the latest updates, security updates, and improvements.
    		June 18, 2019
    02:00 PM PT
    Windows 10, version 1903 available by selecting “Check for updates”
    Windows 10, version 1903 is now available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
    		June 06, 2019
    06:00 PM PT
    Windows 10, version 1903 starting to roll out to devices running Windows 10, version 1803 and earlier
    We are now beginning to build and train the machine learning (ML) based rollout process to update devices running Windows 10, version 1803 (the April 2018 Update) and earlier versions of Windows 10, to ensure we can continue to service these devices and provide the latest updates, security updates, and improvements.
    		June 18, 2019
    02:00 PM PT
    Windows 10, version 1903 available by selecting “Check for updates”
    Windows 10, version 1903 is now available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
    		June 06, 2019
    06:00 PM PT
    Windows 10, version 1903 rollout begins
    The Windows 10 May 2019 Update (Windows 10, version 1903) is available today to commercial customers via Windows Server Update Services (WSUS), Windows Update for Business, and the Volume Licensing Service Center (VLSC)—and to end users who manually select “Check for updates.” We are slowly throttling up availability while we carefully monitor data and feedback.    		May 21, 2019
    10:00 AM PT
    What’s new in Windows Update for Business
    We are enhancing and expanding the capabilities of Windows Update for Business to make the move to the cloud even easier. From simplified branch readiness options to better control over deadlines and reboots, read about the enhancements to Windows Update for Business as a part of Windows 10, version 1903.     		May 21, 2019
    10:00 AM PT
    What’s new for businesses and IT pros in Windows 10
    Explore the newest capabilities for businesses and IT in the latest feature update in the areas of intelligent security, simplified updates, flexible management, and enhanced productivity.     		May 21, 2019
    10:00 AM PT